SMS Acceptable Use Policy

1. Purpose and Application

This SMS Acceptable Use Policy (“AUP”) describes the rules that apply to any party (“the Client”) using SMS products and services provided by 2166246 Ontario Inc. dba Star Telecom (“Star Telecom”) or any of its affiliates (the “SMS Services”), and to any user of the SMS Services, including via any products and services provided by the Client (“End User”).

The Client is responsible for its End Users’ compliance with this AUP. The prohibited conduct described in this AUP is illustrative, not exhaustive. If the Client or any End User violates this AUP, Star Telecom may filter, suspend, or terminate the Client’s use of the SMS Services in accordance with Section 12. Star Telecom may update this AUP from time to time upon reasonable notice, which may be provided via the Client’s account, by email, or by posting an updated version at the URL where this AUP is published.

The SMS Services may be used to send messages to Canadian and United States destinations. The Client is responsible for complying with all laws, regulations, and wireless industry requirements applicable in every jurisdiction where its messages are sent or received, including those summarized in this AUP. This AUP summarizes key requirements for convenience; it is not legal advice and does not relieve the Client of its independent compliance obligations.

2. Regulatory and Industry Framework

Without limitation, the following apply to messaging conducted through the SMS Services:

• Canada: Canada’s Anti-Spam Legislation (CASL) and its regulations; CRTC regulatory requirements; the CWTA Canadian Common Short Code Application Guidelines; the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, including Quebec’s Law 25; and the promotion restrictions of the Cannabis Act.
• United States: the Telephone Consumer Protection Act (TCPA) and FCC implementing rules; the CAN-SPAM Act where applicable; the CTIA Messaging Principles and Best Practices; and applicable state telemarketing and mini-TCPA statutes.
• Carrier requirements: the codes of conduct, content policies, and filtering practices of Canadian and US wireless carriers and their designated aggregators, as amended from time to time.

3. General Acceptable Use

The Client and its End Users must not use the SMS Services to:

• Transmit or store any content or communications that are illegal, harmful, deceptive, unwanted, or objectionable, including content that is false or misleading, that is hateful or encourages hatred or violence against individuals or groups, or that could endanger public safety. Use of the SMS Services by a hate group is prohibited.
• Engage in or encourage any activity that violates the rights of others or is harmful to Star Telecom’s business operations, network, or reputation.
• Create a false identity or mislead others as to the identity of the sender or the origin of any communication, including spoofing, misleading sender IDs, or brand impersonation.
• Interfere with, disrupt, disable, or overload the SMS Services or any interconnected third-party network, including denial-of-service attacks.
• Transmit viruses, malware, or other harmful code, or use bots or other automated means to gain unauthorized access to the SMS Services.
• Attempt to bypass, exploit, defeat, or disable limitations, restrictions, security mechanisms, or filtering applied to the SMS Services, or probe for security vulnerabilities.
• Reverse engineer, copy, disassemble, or decompile the SMS Services.

4. Consent Requirements

Consent is the foundation of lawful A2P messaging in both Canada and the United States. The Client must not send, and must not permit End Users to send, any message through the SMS Services without the level of consent required for the message type and destination.

4.1 All Destinations

• Obtain verifiable consent from the message recipient before sending, appropriate to the nature of the program (transactional, informational, or promotional).
• Send only message types and content that the recipient consented to receive, at the frequency disclosed. Consent obtained for one program or brand must not be reused for another.
• Consent must not be a condition of purchase where applicable law prohibits it, must not be obtained through deceptive means, and must not be bought, sold, rented, or shared between unaffiliated brands. Third-party or purchased lists are prohibited on the SMS Services.
• The Client bears the burden of proving consent and must retain evidence as described in Section 11.

4.2 Canadian Destinations (CASL)

• Commercial electronic messages require express consent or qualifying implied consent under CASL. Implied consent expires: two years after the last transaction in an existing business relationship, and six months after an inquiry. The Client must track expiry and cease sending, or convert to express consent, before expiry.
• Requests for express consent must identify the requester (and any party on whose behalf consent is sought), state the purpose(s) of the consent, include a mailing address plus a phone number, email address, or web address, and state that consent can be withdrawn at any time.

4.3 US Destinations (TCPA / CTIA)

• Marketing messages sent using automated technology require prior express written consent that clearly discloses the brand, the fact that automated marketing texts will be sent, and that consent is not a condition of purchase.
• Informational and transactional messages require at least prior express consent (for example, the recipient knowingly provided their number for that purpose).
• The Client must honor the National Do-Not-Call Registry and applicable state do-not-call and quiet-hour rules for telemarketing messages.

5. Opt-Out Requirements

• Every messaging program must support a clear, conspicuous, and functional opt-out mechanism. Recipients must be able to opt out by replying with standard keywords, at minimum STOP, and the standard variants (UNSUBSCRIBE, CANCEL, QUIT, END) in English and ARRET/ARRÊT in French for Canadian programs.
• Opt-out instructions must be included in the first message of a program and repeated periodically (at minimum every fifth message or monthly for recurring programs).
• Keyword opt-outs must be processed immediately and automatically. For Canadian destinations, all opt-outs must in any event be given effect without delay and no later than 10 business days, and the unsubscribe mechanism must remain valid and functional for at least 60 days after the message is sent.
• Exactly one final opt-out confirmation message may be sent acknowledging the unsubscribe; no further messages may be sent to that recipient under that program thereafter.
• Opt-outs must be applied across all numbers and campaigns operated for the same brand and must be reflected in the Client’s systems of record. Circumventing, delaying, or ignoring opt-out requests is grounds for immediate suspension.

6. Sender Identification and Content Standards

• Every message must identify the brand the recipient consented to hear from and include contact information, or a link to it. Concealing, obscuring, or rotating sender identity is prohibited.
• Use branded, corporate-domain URLs. Public or shared URL shorteners (for example, free tinyurl or bit.ly links) are prohibited, as they are associated with abuse and trigger carrier filtering.
• Do not misuse “emergency” language, impersonate public alerting systems, government agencies, or financial institutions, or otherwise create a false sense of urgency to induce a response.
• Bilingual requirement (Canada): messaging programs directed at Quebec recipients must be available in French, in accordance with the Charter of the French Language (as amended by Bill 96), including French message content, opt-out keywords (ARRET/ARRÊT), HELP/AIDE support, and required disclosures. For other Canadian programs, the Client must respect recipient language preferences and offer French where a materially French-speaking audience is served.
• Marketing sends should occur between 8:00 a.m. and 9:00 p.m. recipient local time unless the recipient has requested otherwise or applicable law imposes stricter windows.

7. Prohibited and Restricted Content

7.1 Prohibited Content (all destinations)

• Content that is illegal in the destination jurisdiction, including content promoting illegal drug sales, counterfeit goods, or fraud (including phishing, smishing, and social-engineering schemes).
• Hate speech, harassment, exploitative or abusive content, and any content that sexualizes or endangers minors.
• High-risk financial content prohibited by carrier codes, including payday and other high-interest loan solicitations, debt collection or debt relief solicitations to third parties, cryptocurrency pump schemes, stock alerts to purchased lists, and work-from-home or get-rich-quick schemes.
• Third-party lead generation and affiliate marketing where the recipient did not consent to hear from the specific advertising brand.

7.2 Restricted Content (permitted only with pre-approval, applicable licences, and controls)

• Content in the SHAFT-C categories — Sex, Hate, Alcohol, Firearms, Tobacco/vape, and Cannabis — is restricted. Alcohol, firearms, tobacco, and gambling content is permitted only where lawful in the destination, with robust age-gating that verifies the recipient’s age at opt-in.
• Cannabis: although cannabis is legal in Canada, its promotion is restricted by the Cannabis Act and by carrier policy; cannabis marketing is prohibited to US destinations under carrier codes regardless of state law. Any Canadian cannabis-related program requires Star Telecom’s prior written approval.
• Sweepstakes, contests, and gambling-adjacent programs require prior written approval and must comply with applicable federal, provincial, and state rules.

8. Prohibited Sending Practices

• Snowshoeing: spreading similar or identical traffic across multiple numbers to evade volume limits, filtering, or per-number reputation controls.
• Number cycling: rotating through numbers to continue sending after filtering or blocking, or acquiring numbers to replace blocked ones for the same traffic.
• Grey routes: sending A2P traffic over routes or number types designated for person-to-person use, or otherwise disguising commercial traffic as conversational traffic.
• Content evasion: deliberately misspelling words, inserting characters, splitting URLs, or otherwise manipulating content to evade carrier or platform filtering.
• List abuse: sending to purchased, rented, harvested, or randomly generated number lists, or to numbers obtained without the recipient’s knowledge.
• Hygiene failures: continuing to send to numbers that have been deactivated or reassigned. Clients must scrub lists against deactivation data and remove persistent non-deliverable numbers.

9. Short Code Requirements

The following apply to programs operated on short codes, in addition to all other sections of this AUP.

9.1 Canadian Common Short Codes (CWTA)

• Programs must run only on CWTA-approved Canadian Common Short Codes, with the program approved through the short code application process before traffic begins. Material changes to the use case, brand, content type, or frequency must be re-filed.
• Each short code program must identify a single brand; leveraging one code across multiple undisclosed brands is prohibited and will result in suspension.
• Recurring or subscription programs require double opt-in (handset confirmation), and programs sending five or more messages per month must disclose message frequency in the opt-in flow and on the first message.
• Standard-rate messages must include the bilingual rate disclosure (“Std msg rates apply” / “Frais Std De Msgs S’appl”), and messages containing URLs must include the data-rate disclosure (“Data rates may apply” / “Frais Données Peuv.S’appl”) or the approved combined form.
• HELP and AIDE keywords must return the brand identity and program description, customer-service contact information (toll-free if a phone number is the only method), the program’s cost and frequency, and opt-out instructions. The INFO keyword must return a single bilingual response, not exceeding two message segments, containing the brand and customer-service contact information.

9.2 US Short Codes (CTIA)

• Programs must comply with the CTIA Short Code Monitoring Handbook and Messaging Principles and Best Practices, including a compliant call-to-action disclosing the brand, program description, message frequency, “message and data rates may apply,” and HELP/STOP references, with links to program terms and a privacy policy.
• HELP must return brand identity and customer support contact; STOP must immediately terminate the program for that recipient with a single confirmation message.
• Recurring-message programs require double opt-in. Shared short codes serving multiple unaffiliated brands are not permitted.

10. Toll-Free SMS (Long Code) Requirements

Toll-free numbers are the sanctioned long-code channel for A2P messaging to Canadian and US destinations and support high-volume application-to-person traffic once verified. The following apply to programs operated on toll-free numbers, in addition to all other sections of this AUP. Registration frameworks specific to US 10DLC (local number) campaign registries are out of scope of this AUP.

10.1 Verification

• Each toll-free number must complete toll-free SMS verification through Star Telecom or its designated aggregator before production A2P traffic begins. Traffic from unverified or pending numbers is subject to filtering or blocking and must be limited to testing.
• The verification submission must accurately describe the legal business identity, brand, use case, sample message content, opt-in workflow (with evidence such as screenshots or URLs), and expected monthly volume. Material changes to the use case, brand, or volume require re-verification.
• Providing false or misleading information in a verification submission is a violation of this AUP and grounds for immediate suspension.

10.2 Program Rules

• One brand per toll-free number. Leveraging a single toll-free number across multiple brands, or omitting brand identity from messages, is prohibited and will result in suspension.
• All consent, opt-out, identification, and content rules in Sections 4 through 8 apply in full to toll-free traffic, including support for STOP and HELP keywords. Toll-free programs sending to Canadian recipients must also support the French keywords ARRET/ARRÊT and AIDE, and Quebec-directed programs must meet the bilingual requirement in Section 6. Adoption of the CWTA-style rate-disclosure conventions described in Section 9.1 is strongly recommended for all Canadian toll-free programs.
• Toll-free numbers used for messaging must be provisioned for voice so that recipients can call the number that texts them, and the organization’s website should reference the toll-free number and its purpose.
• Actual sending volume and throughput must remain consistent with the volumes declared at verification. Sustained material increases require re-verification; burst patterns significantly exceeding declared volume are subject to filtering.
• Splitting one campaign across multiple toll-free numbers to increase aggregate throughput or evade per-number controls is prohibited (see Section 8).

10.3 Local (Geographic) Long Codes

• Local 10-digit geographic numbers are not a sanctioned A2P channel for Canadian destinations and are aggressively filtered by Canadian carriers; bulk or recurring A2P campaigns must use a Canadian Common Short Code or a verified toll-free number.
• Use of local long codes for A2P traffic to US destinations is governed by US campaign-registry requirements outside the scope of this AUP; absent such registration, A2P traffic on local long codes is prohibited on the SMS Services.

11. Data Safeguards, Privacy, and Recordkeeping

• The Client is responsible for determining whether the SMS Services offer safeguards appropriate to its use, including any required by applicable law, before transmitting or processing data or communications, or permitting End Users to do so.
• Phone numbers, consent records, and message data must be handled in accordance with PIPEDA and applicable provincial privacy laws (including Quebec Law 25) for Canadian data subjects, and applicable US federal and state privacy laws for US data subjects.
• The Client must retain proof of consent (date and time, source, the exact consent language presented, and IP address where applicable), message logs, and opt-out records for at least three years, and consent records for the life of the customer relationship plus three years, and must produce them to Star Telecom on request in connection with a carrier audit or complaint investigation.
• Opt-out lists must not be sold, shared, or reused for any other purpose.

12. Monitoring, Enforcement, and Reporting

Star Telecom and its subprocessors may collect and monitor the content of messages transmitted via the SMS Services to United States and Canadian numbers in order to detect spam, fraudulent activity, and violations of this AUP. Prior to using the SMS Services, the Client will provide notice to, and obtain and document consent from, the sender and recipient of text messages to permit Star Telecom to (a) transmit such messages and (b) collect and monitor their content for those purposes.

Star Telecom may, with or without notice depending on severity, filter or block non-compliant traffic, require remediation of a program, suspend a number or campaign, or suspend or terminate the Client’s use of the SMS Services. Carrier-initiated blocking, fines, or audit findings attributable to the Client’s traffic may be passed through to the Client in accordance with the applicable services agreement.

Violations of this AUP may be reported to compliance@startelecom.ca. The Client agrees to immediately report any violation of this AUP to Star Telecom and to cooperate, as requested, in investigating and remedying the violation.