Kulu Acceptable Use Policy

1. Purpose and scope

This Acceptable Use Policy ("AUP") sets out what Kulu allows and what it turns away on its messaging platform and managed services (the "Services"). Carriers, aggregators and the people receiving every message depend on senders acting responsibly, and Kulu enforces these standards itself.

This AUP applies to every Customer, every user, and end customer that sends through a Customer's account or branded portal. Customers are responsible for making sure their own customers comply. This AUP is part of our Terms of Service, and our Privacy Policy explains how we handle personal information.

All programs must comply with applicable law (including the Telephone Consumer Protection Act and state telemarketing laws), the CTIA Messaging Principles and Best Practices, and carrier codes of conduct. Where those rules are stricter than this AUP, the stricter rule applies.

2. Messaging standards and prohibited content

Required messaging practices. Every program on Kulu must:

• Obtain documented opt-in before the first message, through a method that matches the registered use case (for example web form, keyword, paper form or point of sale). Consent for one brand does not carry over to another. Marketing messages require prior express written consent where the law requires it.
• Disclose clearly at opt-in the brand name, the type of messages, expected message frequency, that message and data rates may apply, how to get help (HELP) and how to opt out (STOP), and links to the program's terms and privacy policy. Consent to receive messages may not be a condition of purchase.
• Send a confirmation message after opt-in that repeats the brand name, frequency, rates disclosure, and HELP and STOP instructions.
• Identify the brand in every message, and include opt-out instructions in the first message and periodically in recurring marketing programs.
• Honor opt-outs immediately. STOP, END, CANCEL, UNSUBSCRIBE, QUIT, STOPALL and reasonable plain-language equivalents must stop all further messages from that program, other than a single confirmation that the recipient has been unsubscribed.
• Respond to HELP with the brand name, support contact information and opt-out instructions.
• Keep consent and opt-out records for at least 4 years and produce them on request.
• Age-gate restricted content where carriers allow it at all, and never message anyone known to be under the legal age for the content.
• Send only what was registered. Message content, sample messages, opt-in flow and use case must match the approved registration, and material changes require Kulu review before sending.

Prohibited sending practices. You may not use the Services to:

• Send any message without documented, verifiable consent appropriate to the message type, or after a recipient has opted out.
• Send to purchased, rented, shared, appended, scraped or harvested lists, or to numbers generated randomly or sequentially.
• Engage in third-party or affiliate lead generation, lead sharing, or sending on behalf of a business other than the registered brand.
• Fail to identify the sending brand, or disguise, spoof or misrepresent the sender, caller ID or message origin.
• Use snowshoeing, number rotation, or any technique meant to evade filtering, throughput limits or carrier review.
• Send content or use cases that differ from what was registered or approved, or change content after approval without review.
• Use shared or public URL shorteners, or links that redirect to undisclosed destinations.
• Send messages outside permitted hours under applicable quiet hours laws.

Prohibited content. You may not send, link to or promote:

• SHAFT content: sex or adult content, hate speech, alcohol, firearms or ammunition, and tobacco, vaping or cannabis (including CBD, kratom and similar products), except where specifically approved by Kulu and permitted by carriers with required age gating.
• Illegal drugs, controlled substances, or prescription medication sold without a valid prescription.
• Gambling, sweepstakes or contests not compliant with law and carrier rules.
• High-risk financial offers, including payday loans, short-term high-interest loans, debt consolidation, debt reduction or credit repair, cryptocurrency investment offers, and get-rich-quick or work-from-home schemes.
• Debt collection messages, except where specifically approved by Kulu and compliant with the Fair Debt Collection Practices Act and Regulation F.
• Phishing, smishing, malware, fraud, deceptive or misleading content, or impersonation of any person, business or government agency.
• Content that is defamatory, harassing, threatening, violent, or that promotes self-harm or exploitation of minors.
• Content that infringes intellectual property or privacy rights.
• Political or issue advocacy messages that do not meet legal disclosure requirements and carrier rules for political campaigns.

Other prohibited uses. You may not use the Services for any unlawful purpose, to send emergency or life-safety alerts as a primary channel, or in any way that harms Kulu's relationships with carriers or aggregators or degrades the messaging channel for others.

Kulu may decline any program, brand or use case it considers high risk, even if not listed above.

3. Security and technical restrictions

You may not:

• Access or attempt to access accounts, sub-accounts, data or systems you are not authorized to use, or probe, scan or test the vulnerability of the Services without Kulu's written permission.
• Share credentials or API keys, or allow unvetted parties to send through your account.
• Interfere with or disrupt the Services, including by overloading, flooding or denial-of-service attacks, or by bypassing rate limits, throughput controls or usage caps.
• Introduce viruses, malware or other harmful code.
• Reverse engineer, decompile or copy the Services, except as law allows.
• Use the Services to store or transmit payment card numbers, Social Security numbers, account passwords, or protected health information unless permitted in your Order and supported by appropriate safeguards and agreements.

You must keep accurate records of consent, opt-outs and campaign content, and provide them to Kulu within 2 business days of a request from Kulu, a carrier or a regulator.

4. Monitoring, reporting and enforcement

Monitoring. Kulu reviews every partner and sending brand before onboarding, reviews campaigns before launch and whenever they change, and monitors traffic continuously for complaints, opt-out spikes, carrier flags, content changes and misuse. You consent to this monitoring.

Enforcement. If we believe this AUP has been violated, we may, at our discretion and without liability:

• Request information, corrective action or a remediation plan.
• Block specific messages, pause campaigns, or throttle traffic.
• Suspend or deprovision numbers, campaigns, sub-accounts or the entire account.
• Withdraw or decline to file registrations.
• Terminate the Services under the Terms of Service.
• Report activity to carriers, aggregators, registration bodies or law enforcement.

We will give notice when practical, but we may act first when needed to protect recipients, carriers or the channel. You are responsible for any carrier fines, penalties or pass-through charges caused by your traffic.

Reporting abuse. To report spam, unwanted messages or other abuse sent through Kulu, email help@kulu.io with the sending number, the message content, and the date and time received. If you received an unwanted text, you can also reply STOP to opt out, or forward it to 7726 (SPAM).

Changes. We may update this AUP as laws, carrier rules and industry standards change. Updates take effect when posted, and we will notify Customers of material changes.

Questions: help@kulu.io