Acceptable Use & Call Recording Policy

3.1 Violate the Law

• Engage in any conduct that violates applicable federal, state, or local law, including the Telephone Consumer Protection Act (TCPA), the Telemarketing Sales Rule (TSR), the Truth in Caller ID Act, the federal Wiretap Act, state wiretap and call-recording statutes, consumer protection laws, fair lending and fair housing laws, the FTC Act, HIPAA (to the extent applicable to your business), and the laws of any foreign jurisdiction where your call recipients are located.
• Place calls to numbers on the federal Do Not Call Registry or any state DNC registry, or to any individual or business that has revoked consent or asked to be placed on your internal Do Not Call list, except as permitted by an applicable exemption (e.g., established business relationship, prior express written consent for telemarketing, B2B calls where permitted).
• Use a false, misleading, inaccurate, or 'spoofed' caller ID, or otherwise misrepresent the identity of the calling party.
• Engage in robocalling or pre-recorded message campaigns to mobile or residential numbers without the prior express written consent required by the TCPA, or in any campaign that would constitute illegal robocalling.

3.2 Harm or Deceive Recipients

• Impersonate any person, business, government agency, or other entity, or misrepresent your affiliation with any party.
• Engage in fraud, phishing, 'vishing', pretexting, social engineering, identity theft, romance scams, investment scams, government-impersonation scams, fake debt collection, or any other deceptive scheme.
• Harass, threaten, intimidate, defame, or invade the privacy of any person.
• Use the Service to deliver unlawful debt collection, including failing to provide validation notices, calling consumers at prohibited times, or contacting third parties improperly under the Fair Debt Collection Practices Act.
• Provide unlicensed medical, legal, financial, tax, immigration, or other regulated professional advice, or use the AI receptionist in a way that gives recipients the impression they are speaking with a licensed professional when they are not.

3.3 Promote Prohibited Content or Industries

You may not use the Service in connection with:

• Adult content, sex work, escort services, or sexual services
• Firearms, ammunition, explosives, or weapons sales
• Illegal drugs, controlled substance fulfilment, or unlicensed pharmacies
• Multi-level marketing schemes, pyramid schemes, or 'get rich quick' promotions
• Unlicensed gambling, lotteries, or sweepstakes
• Cryptocurrency promotions targeted at consumers, ICOs, or 'pump and dump' schemes
• Predatory lending, payday lending where prohibited, or loan modification schemes
• Hate speech, incitement of violence, or content that targets a protected class
• Any business that has been the subject of an enforcement action by the FTC, FCC, CFPB, or a state attorney general for telemarketing, consumer protection, or call-recording violations, unless you have disclosed the matter to us and we have approved your use in writing

3.4 Abuse the Service or Infrastructure

• Attempt to gain unauthorised access to the Service, our systems, our other customers' accounts, or any underlying infrastructure (Twilio, Vapi, WhatsApp, our cloud providers, or others).
• Probe, scan, or test the vulnerability of any system or network, or breach or circumvent any security, authentication, or rate-limiting measures.
• Reverse engineer, decompile, or attempt to extract the source code, model weights, prompts, or training data of the Service, except to the extent expressly permitted by applicable law.
• Use the Service to transmit malware, ransomware, viruses, worms, or any other harmful code.
• Use the Service in any manner that could disable, overburden, damage, or impair the Service or interfere with any other party's use of it, including by sending excessive traffic, repeated identical calls or messages, or workloads designed to consume disproportionate resources.
• Resell, sublicense, or provide the Service to any third party, or use the Service to build, train, or improve a competing product.

3.5 Misuse AI Outputs

• Hold out the AI receptionist as a human in jurisdictions or contexts where disclosure that the caller is interacting with an automated system is required by law (including, where applicable, California's 'Bot Disclosure' law).
• Configure the AI receptionist to assert facts about prices, availability, qualifications, certifications, medical advice, legal advice, or guarantees that you know to be inaccurate, or that the AI cannot validate against a tool or data source.
• Use the Service to generate, store, or transmit defamatory or harassing content about an identifiable person.

5.1 Federal Baseline

Under federal law (the Wiretap Act, 18 U.S.C. § 2511), it is generally lawful to record a call if at least one party to the call has consented. Many states follow this “one-party consent” rule.

5.2 All-Party Consent States

A number of states require the consent of all parties to a call before it may lawfully be recorded. As of the effective date of this AUP, these states include:

• California
• Connecticut
• Delaware
• Florida
• Illinois
• Maryland
• Massachusetts
• Montana
• Nevada (per state supreme court interpretation)
• New Hampshire
• Oregon (with state-specific nuances)
• Pennsylvania
• Washington

State law changes — you are responsible for keeping current with the law of every state in which your call recipients are located. When a call involves parties in different states, the stricter rule generally applies.

5.3 Required Disclosure

If you record or transcribe calls through the Service, you must, at a minimum:

• Provide a clear and conspicuous notice at the beginning of every call that the call is being recorded, before any substantive conversation takes place; or
• Obtain documented prior consent from the caller through another lawful means (for example, in a written agreement or via an IVR consent prompt).

The following sample greeting, played or spoken at the start of the call, is a starting point — you are responsible for confirming it is sufficient for your use case and the laws applicable to your callers:

For outbound calls, the disclosure must be made before recording begins. For inbound calls, the disclosure should be the first message the caller hears.

5.4 Healthcare, Financial Services, and Other Regulated Industries

If you operate in a regulated industry, additional rules may apply to what you record, store, and disclose — including HIPAA for protected health information, GLBA for non-public personal financial information, and various state laws governing biometric, genetic, and other sensitive data. The Service is not offered as a HIPAA-compliant service unless we have signed a Business Associate Agreement with you in writing.

5.5 International Calls

If you call recipients located outside the United States, additional or different recording and notice obligations may apply, including under the GDPR (EU/EEA/UK), PIPEDA (Canada), the Australian Privacy Act, and various national wiretap laws. You are responsible for compliance.