Calling, Texting, Email and Recording Rules

These Calling, Texting, Email and Recording Rules (the "Rules") are part of the Terms of Service and the Acceptable Use Policy. They apply to every customer that uses the Cheetah OS power dialer, text messaging, call recording, email outreach, or (when available) AI voice agents, and to every User who uses those features. Capitalized terms not defined here have the meanings given in the Terms.

These Rules set minimum standards for using the Service. They are not legal advice and they are not a complete statement of the law. Telemarketing, messaging and recording laws differ between states and countries, change often, and are the subject of frequent litigation. You must get your own legal advice and follow the law that applies to each communication, even where it is stricter than these Rules.

1. Your Role and Ours

1.1 You are the caller and sender

For every call, text, voicemail, email and recording made through your account, you are the caller, sender, seller and telemarketer (as applicable), and you are responsible for it. You decide whom to contact, when, how often, with what content, and from which numbers and mailboxes.

1.2 What we do and do not do

We provide software and connect it to carriers and mailbox providers. Cheetah Technologies does not choose recipients, supply or sell lead lists, write or approve your message content, design or run your campaigns, or place calls or send messages on its own behalf through your account. Our staff do not operate customer campaigns. Our defaults and guardrails help you comply, but they do not make any communication lawful, and they do not shift responsibility for your communications to us.

2. Before You Enable Calling or Texting

2.1 Business verification and attestation

Before we enable calling or texting, we may ask for your legal business name, EIN, business address, website, licenses and registrations, a description of your intended use, sample messages, and a description of how you obtain consent. You must confirm that you understand and will follow these Rules. We may decline to enable, or may limit, any feature based on our review.

2.2 Carrier account

Calling and texting are provided through our carrier partner Telnyx. Cheetah holds the carrier account and provisions your phone numbers. Your organization must pass our identity and business verification before calling or texting is turned on, and your texting brand and campaigns are registered in your own business name (10DLC), which we submit through the carrier on your behalf. We respond to carrier and industry traceback requests and may pause a number while one is open. You must follow the carrier's rules as well as these Rules.

2.3 Text messaging registration (10DLC)

US carriers block business text messages sent from ordinary ten-digit numbers unless the sending brand and campaign are registered through The Campaign Registry. You must register your own brand, using your own business identity and EIN, and each messaging campaign, with an accurate description of the use case, sample messages, opt-in method and opt-out language. You must send only the kind of messages your registered campaign describes. Carrier registration and campaign fees are your responsibility. Carriers apply extra scrutiny, and may refuse or restrict campaigns, for lending, loan solicitation and lead generation content.

2.4 Telemarketer registration

Several states require telephone solicitors to register, pay a fee or post a bond before calling or texting their residents, including (among others) Texas, Arizona, Tennessee, Pennsylvania, New Jersey and Florida, and some have exemptions for certain business calls or consent-based programs. You are responsible for determining which apply to you and for completing them before you contact residents of those states.

2.5 Demo accounts

Demo accounts cannot place real calls or send real texts. Demo accounts must not be used to send email to real recipients.

3. Consent

3.1 What consent you need

Under the federal Telephone Consumer Protection Act (TCPA) and FCC rules:

• calls and texts made with an autodialer, or using an artificial or prerecorded voice, to a wireless number require the recipient's prior express consent;
• if the call or text includes advertising or telemarketing, you need the recipient's prior express written consent: a written agreement, which can be signed electronically, that clearly authorizes you to contact that number using that technology for marketing, and that states consent is not a condition of any purchase; and
• there is no general business-to-business exemption for calls or texts to cell phones. Business owners are usually reached on their own mobile phones.

Several states have their own consent laws that can be broader than federal law, for example requiring prior express written consent for calls or texts made with automated systems that select or dial numbers (including Florida, Oklahoma, Maryland and others). Where a state law is stricter, you must follow it.

3.2 Consent records

For every contact you call or text, you must be able to prove consent. Keep, for each consent: the phone number, the name of the person who consented, the business or businesses they authorized to contact them, the exact consent language shown, the date and time, the source (for example web form URL, paper application or recorded call), and the IP address or other evidence of the signature where applicable. The Service lets you record a consent category for each contact; you must keep the full consent evidence described above yourself. Keep consent records for at least four years after your last contact with that number, or longer if a law requires.

3.3 Purchased, shared and aged leads

Many telemarketing lawsuits start with lead lists. You must not call or text any number obtained from a third party (including lead generators, list brokers, "aged lead" sellers or other brokers) unless:

1. the recipient's consent specifically names your business, or clearly and conspicuously covers your business in a way the law recognizes;
2. the consent was obtained for the type of contact and technology you will use;
3. you can obtain and produce the consent record on request; and
4. the consent has not been revoked and is not stale under your own policy or any applicable law.

Cheetah Technologies does not provide lead lists. You must not import or use lists that were scraped, harvested or compiled without consent.

4. Do Not Call

4.1 National and state lists

Before any telemarketing call or text, you must scrub the number against the National Do Not Call Registry (using your own subscription account number) at least every 31 days, and against any state do not call list that applies. You must also check reassigned number data where appropriate, so you do not reach a new subscriber who never consented. Business owners' mobile phones used for both personal and business purposes are frequently treated as residential numbers, so do not assume a number is exempt because it belongs to a business owner.

4.2 Your internal do not call list

You must maintain a written internal do not call policy, train your staff on it, and keep an internal do not call list. When anyone asks you not to contact them, add them to your internal list across every channel and honor the request. The Service maintains an internal do not call list for your account and blocks dialer calls to numbers on it. It does not currently block texts to those numbers, so you must not text them.

5. Calling and Texting Hours

5.1 Legal limits

Federal law prohibits telephone solicitations before 8 am or after 9 pm in the called person's local time. Several states are stricter. For example, Florida, Oklahoma, Maryland, Oregon and Washington generally limit calls to 8 am to 8 pm, Connecticut to 9 am to 8 pm, and some states restrict calls on Sundays or holidays.

5.2 Platform default

By default, the Service blocks dialer calls outside 8 am to 9 pm in the recipient's estimated local time. It estimates the time zone from the contact's state or the number's area code. The window can be configured for your account. The Service does not apply this window to texts, does not block Sundays or holidays, and allows a call when it cannot determine the recipient's time zone. You are responsible for the stricter state limits described above, for texting hours, and for any call where the time zone is uncertain.

6. Frequency Caps

Some states limit how often you may call or text the same person about the same subject (for example, no more than 3 calls in 24 hours in Florida, Oklahoma and Maryland). The Service does not currently enforce a frequency cap. You are responsible for complying with every frequency limit that applies to you.

7. Opt-Outs Across Every Channel

7.1 Honoring opt-outs

A person may revoke consent or ask you to stop contacting them by any reasonable means, including by replying to a text, by saying so on a call, by email, or in writing. You must treat the following text replies as opt-outs: STOP, QUIT, REVOKE, OPT OUT, CANCEL, UNSUBSCRIBE and END, and any other words that reasonably express a wish to stop. You may send one confirmation message that contains no marketing. Federal rules require opt-outs to be honored within 10 business days. The Service does not currently process inbound text replies, so it does not detect opt-out keywords automatically. You must monitor replies and record opt-outs, for example by adding the number to your internal do not call list.

7.2 One opt-out, every channel

We recommend applying an opt-out received in one channel to all marketing calls, texts and emails to that person from your account. The Service does not do this automatically today, so you must apply it yourself. Federal rules applying opt-outs to all message types are scheduled to take effect on January 31, 2027, and you must comply with them when they do.

7.3 Voice opt-outs

Every telemarketing call made with an artificial or prerecorded voice must offer an automated way for the recipient to opt out during the call. Agents must honor spoken requests to stop calling and record them in the Service.

7.4 Email opt-outs

Email opt-outs are covered in Section 12.

8. Caller ID and Number Reputation

You must:

1. transmit accurate caller ID on every call, showing a number that you are authorized to use and that a recipient can call back during business hours to reach you or ask to stop receiving calls;
2. never spoof or disguise caller ID, and never display a number to mislead, defraud or cause harm;
3. use only numbers assigned to your account;
4. never rotate, cycle or replace numbers to evade spam labeling, blocking or opt-outs; and
5. monitor your numbers' reputation and stop using any number labeled as spam until you have found and fixed the cause.

We may retire or replace numbers that carriers or analytics providers flag, and we may suspend calling from your account if flags indicate a pattern of unwanted calls.

9. Automated and Predictive Dialing

If you use predictive or automated dialing modes, you must follow federal abandoned-call rules:

1. no more than 3 percent of calls answered by a person may be abandoned, measured per campaign over each 30-day period;
2. a call is abandoned if it is not connected to a live agent within 2 seconds of the recipient's greeting;
3. every abandoned call must play a prerecorded message identifying your business and giving a telephone number the recipient can call to opt out; and
4. unanswered calls must ring for at least 15 seconds or four rings before disconnecting.

The Service does not offer predictive dialing: its dialer connects the agent first and dials the recipient only after the agent is on the line. If you use any other automated dialing tool, you are responsible for these limits. Artificial or prerecorded voice messages, including ringless voicemail and voicemail drops, require the consent described in Section 3, must identify your business at the start, and must include a callback number.

10. Honest Content

Every communication must be truthful. You must identify your business, and you must not misrepresent the cost, terms, approval odds, speed or nature of any financing, your affiliation with any lender, funder or government program, or the reason for your call. The Telemarketing Sales Rule's prohibitions on misrepresentations apply to business-to-business calls. Avoid claims such as "guaranteed approval" or "pre-approved" unless they are literally true for that recipient. State commercial financing laws may also restrict how you advertise financing.

11. Call Recording

11.1 Consent laws

Federal law and most states allow a call to be recorded with the consent of one party. However, several states require the consent of every party to the call. Based on current research, you should treat the following states as requiring all-party consent: California, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, Nevada, New Hampshire, Pennsylvania and Washington, and, because their law is mixed or unsettled, Connecticut, Michigan, Oregon and Vermont. The law of the stricter state commonly applies to calls that cross state lines, and area codes are not a reliable guide to where someone is.

11.2 Platform default

Because the Service cannot reliably know where a recipient is, on recorded dialer calls each party hears a notice that the call may be recorded when they join the call. Recording of the call can begin before the recipient joins, so the recipient hears the notice after recording has started. Customers cannot turn the notice off. The Service does not currently provide a control to stop recording during a call; if anyone on the call objects to recording, your agent must end the call.

11.3 Transcription and AI analysis

If you use transcription, summaries or other AI analysis of calls, your announcement must disclose that automated tools will process the call. We process recordings and transcripts only to provide the Service to you, and neither we nor our providers use them to train AI models. See Section 7.4 of the Terms of Service.

11.4 Retention

You are responsible for deciding how long to keep recordings and transcripts, consistent with the law and your own policies. The Service does not currently provide recording retention settings; contact us at info@cheetahos.app if you need recordings deleted.

12. Email

12.1 CAN-SPAM requirements

The CAN-SPAM Act applies to business-to-business commercial email. Every commercial email you send through the Service must:

1. use accurate "From", "To", "Reply-To" and routing information that identifies you as the sender;
2. use a subject line that is not deceptive;
3. identify the message as an advertisement unless the recipient has given affirmative consent to receive it;
4. include your valid physical postal address;
5. include a clear, working way to opt out, which must continue to work for at least 30 days after you send the message;
6. honor opt-out requests within 10 business days; and
7. never sell, rent or transfer the email address of anyone who has opted out.

12.2 Platform defaults

The Service adds an unsubscribe link and your postal address to outreach email, prevents their removal, and adds unsubscribed addresses to a suppression list for your account that applies across all your sequences.

12.3 Connected mailboxes and deliverability

Email you send through a connected Gmail, Microsoft or IMAP mailbox is sent under your mailbox provider's rules and sending limits. Large mailbox providers also require bulk senders to authenticate their domains (SPF, DKIM and DMARC), to support one-click unsubscribe, and to keep complaint rates low. Failing those rules can lead to your mail being filtered or your mailbox being restricted. Transactional email that we send to you (for example receipts, security notices and account messages) is sent through our own email provider and is not outreach.

12.4 State email laws

Some state laws on false or misleading commercial email remain in force alongside CAN-SPAM, including California's law on deceptive headers and subject lines. You must not use purchased or scraped email lists that you have no lawful basis to use.

13. AI Voice Agents (Planned)

AI voice agents are not yet available. If and when we make them available, these rules will apply in addition to the rest of these Rules:

1. Consent. An AI-generated voice is an "artificial" voice under the TCPA, so every AI voice call to a wireless number requires prior express consent, and every AI voice telemarketing call requires prior express written consent that covers artificial or prerecorded voice calls. The Service will be designed to block AI voice calls to any number without a stored consent record.
2. Disclosure at the start. Every AI voice call must begin by stating that the caller is an automated AI assistant, naming your business, and giving a callback number. California requires a natural-voice announcement disclosing an artificial voice before certain prerecorded messages, and other states require AI disclosure in some circumstances. Always disclosing at the start meets these rules.
3. Opt-out. The agent must honor a spoken request to stop calling and record it as an opt-out.
4. No impersonation. You must not use an AI voice that imitates any real person without that person's written consent, and you must never present the AI as a human.
5. Monitoring. We may monitor AI voice deployments for abuse and suspend them under Section 16.

14. United Kingdom Outreach

When the Service is available in the UK, these additional rules apply to calls, texts and emails to UK numbers and addresses:

1. Email and text marketing. Under the Privacy and Electronic Communications Regulations 2003 (PECR), you may send unsolicited marketing emails and texts to corporate subscribers (such as limited companies and LLPs) if you identify yourself and offer an opt-out. Sole traders and most partnerships in England and Wales are treated like individuals, and you need their consent or must meet the "soft opt-in" conditions. The Service does not currently record UK subscriber type, so you must track it yourself.
2. Live marketing calls. You must not make marketing calls to numbers registered with the Telephone Preference Service (TPS) or Corporate Telephone Preference Service (CTPS) unless the subscriber has specifically consented to your calls, and you must not call anyone who has asked you not to. Screen UK numbers against TPS and CTPS at least every 28 days. [[FILL: confirm TPS and CTPS screening integration is live before UK launch.]]
3. Automated calls, including AI voice. Automated marketing calls, which you should assume include AI voice calls, require the recipient's prior specific consent to automated calls from you. This applies to corporate as well as individual subscribers. AI voice agents will be disabled for outbound UK marketing calls unless that consent is recorded.
4. Caller ID. Every call must present a valid UK number that can be called back and that you are authorized to use. UK calls must be originated through a UK-licensed carrier; calls from abroad presenting UK numbers may be blocked.
5. Abandoned and silent calls. Ofcom expects no more than 3 percent abandoned calls per campaign per 24 hours, a brief recorded information message on any abandoned call identifying you and giving a number to opt out, no repeat call to an abandoned number within 72 hours unless a live agent is guaranteed, a minimum ring time of 15 seconds, and records to show compliance. Answering machine detection false positives count as abandoned calls.
6. Recording notices. You must make reasonable efforts to inform people that calls may be recorded and, under UK data protection law, tell the other party that the call is recorded, why, and how long the recording is kept.
7. Privacy information. You must give recipients the privacy information UK data protection law requires, including a link to your privacy notice.

15. Records You Must Keep

Keep records sufficient to prove compliance, for the longest period that applies to you, including consent records, do not call scrubs, internal do not call requests, opt-outs, call detail records, copies of prerecorded and artificial voice messages, recordings and transcripts you retain, message content, and campaign registrations. The Telemarketing Sales Rule requires sellers and telemarketers to keep certain records for five years, and TCPA claims can generally be brought for four years. The Service retains records according to your settings and our retention schedule; export anything you must keep before you delete it or close your account.

16. Monitoring, Complaints, Tracebacks and Suspension

16.1 What we watch

To protect recipients, carriers and other customers, we may monitor communication metadata and abuse signals from your account, such as call volumes, short call durations, answer and abandonment rates, opt-out and complaint rates, carrier and analytics spam labels, and complaints we receive. We may review content where reasonably necessary to investigate a complaint or suspected violation.

16.2 Tracebacks and complaints

If we receive an industry traceback request, a carrier inquiry, a complaint, or a regulator's or law enforcement request about traffic from your account, you must respond to our request for information (including consent records) within one business day, or sooner if the request requires it, so we can meet our own obligations. We may share relevant information with the requester where lawful.

16.3 Suspension

We may immediately suspend calling, texting, email sending, recording, AI voice or specific numbers, campaigns or mailboxes, as described in Section 23 of the Terms of Service, if we reasonably believe you have breached these Rules, if a carrier or other provider requires or requests it, or if abuse signals or complaints indicate unwanted or unlawful communications. Carrier fines assessed because of your traffic may be passed through to you.

17. What the Platform Is Designed to Do by Default

The table below summarizes the default safeguards the Service applies today, and what it does not yet do. Defaults help, but they are not a substitute for your own compliance program, and some may not apply to every feature or configuration.

18. Changes to These Rules

Telemarketing and messaging law changes frequently. We may update these Rules under Section 33 of the Terms of Service, and we may apply stricter rules immediately where a change in law, a carrier's rules, or an urgent risk of harm requires it.

Contact

• Cheetah Technologies LLC
• Email: info@cheetahos.app
• Mailing address: [[FILL: mailing address]]

To report an unwanted call, text or email from a sender that uses Cheetah OS, email info@cheetahos.app with the number or sender, the date and time, and what was received.