Consent & Legal Guidance

Finn is a Software-as-a-Service platform that businesses in India, the United States, Europe and elsewhere use to run AI agents on phone calls, WhatsApp, website chat, SMS and email, to manage those conversations in a shared inbox, and to let their own sales representatives call leads with the Rep Parallel Dialer. You decide whom you contact, why, when, how often and what is said. The consent, data sourcing and legal compliance of every call, message and email sent through Finn are your responsibility, under the laws of each place where you operate and where the people you contact are.

These operational standards keep your service running and protect the phone numbers, sender registrations and WhatsApp accounts you use. They are Finn’s acceptable use policy for calls, messages and emails, and form part of the Finn General Terms and Conditions, which you accept when you create an account.

1. Rules for Every Channel

On every channel:

• Have a lawful basis — and, where the law requires it, consent — before you contact anyone. Consent must cover the channel you use and, for calls that use an AI or prerecorded voice, the use of that voice.
• Honor opt-outs made by any reasonable means — for example a reply of STOP, “stop calling” on a call, or an email — promptly, and always within the time the law allows (in the US, 10 business days).
• Keep records of each person’s consent and opt-out, and of where each contact came from.
• Say who you are, and tell people when they are talking to an AI or being recorded, wherever the law requires it.
• Check do-not-call and do-not-disturb registers, and don’t contact people on them unless an exemption or their consent applies.
• Never send content that is fraudulent, deceptive, harassing, or prohibited by law, by carrier rules or by Meta’s policies.
• Don’t send protected health information through chat AI agents or the Rep Parallel Dialer unless Finn has agreed to it in writing.

2. Mandatory Compliance Artifacts & Declarations

By using Finn, you formally warrant that every call, message and email you send complies with the telemarketing, messaging, data-protection and financial communication laws that apply to you — including but not limited to TRAI’s commercial communication rules (TCCCPR), RBI guidelines and the Digital Personal Data Protection Act 2023 (India); the TCPA and FCC rules, the FTC’s Telemarketing Sales Rule, national and state Do-Not-Call laws and the CAN-SPAM Act (United States); and the GDPR and the ePrivacy Directive, and in the UK the UK GDPR and PECR (Europe). Upon any complaint or inquiry from a regulator, carrier, Meta or recipient, you must provide one of the following artifacts to Finn at [email protected] within 24 hours:

• Explicit End-User Consent: Verifiable proof (timestamped digital opt-in, signed document, or CRM log) that the person explicitly agreed to receive the communication from your entity on that channel, meeting the consent standard of the applicable region — e.g. prior express written consent under the TCPA for marketing calls that use an AI or prerecorded voice, an opt-in naming your business for SMS or WhatsApp, or freely-given consent under the GDPR.
• Verified Inbound Call Proof (Finn's 72-hour standard): Call Detail Records (CDRs) proving the end-user initiated contact (incoming or missed call) within the preceding 72 hours, for callbacks. This is Finn's evidence standard, not a legal exemption; the law of your region still decides whether the callback is allowed.
• Strictly Transactional Intent: Recordings, message logs, or approved script and template logs proving the communication’s intent was purely transactional, support-oriented, or informational, and entirely devoid of promotional messaging.
• Proper Numbering & Registry Allocation: Proof of using the numbering series and registrations mandated in your region — e.g. in India, DLT registration, 140-series numbers for promotional calls, 1600-series numbers for service and transactional calls where TRAI requires them (for example, for regulated financial entities), registered SMS headers and templates, and your declaration of automated (A2P) calling to your operator where TRAI requires it; in the US, a caller ID compliant with FCC rules, scrubbing against the National Do-Not-Call Registry, and an approved 10DLC brand and campaign (or verified toll-free number) for SMS; in the UK, screening of marketing calls against the TPS and CTPS; or a registered sender identity under local telecom rules in the EU.
• AI Disclosure & Recording Consent: You are responsible, as the party deploying the Agent or placing the call, for ensuring your calls and chats legally comply with all regional requirements to disclose that a call is being recorded and/or that the End Customer is interacting with an Artificial Intelligence system, including two-party consent recording laws in applicable US states, US state AI-disclosure laws, and GDPR transparency and EU AI Act (Article 50) disclosure requirements in the EU.

3. WhatsApp

When you connect WhatsApp, you use your own WhatsApp Business Account under your own agreement with Meta, and you must follow Meta’s terms and policies, including the WhatsApp Business Messaging Policy and the WhatsApp Commerce Policy. In particular:

• Message people only after they have opted in to receive WhatsApp messages from your business, and stop when they ask you to.
• Reply freely only within 24 hours of the person’s last message; after that, send only message templates Meta has approved, in the correct category.
• Use your AI agent only to serve your own customers about your own business, not as a general-purpose AI assistant, and give people a clear way to reach a person.
• Don’t offer goods or services the WhatsApp Commerce Policy prohibits, and don’t ask people to send full payment-card numbers, financial account numbers or national ID numbers in a chat.
• Keep a valid payment method on your WhatsApp Business Account. Meta bills its WhatsApp fees to you directly, and they are not part of Finn’s fees.

Meta, not Finn, decides whether to approve your business, display name, phone number and templates, sets your messaging limits and quality rating, and may restrict or disable your number or account. Finn cannot reverse Meta’s decisions.

4. SMS

Before and while you send SMS through Finn:

• In the US, register your brand and campaign for 10DLC (or verify your toll-free number) with accurate details, and send only the type of messages your campaign was approved for. Finn can make these registrations for you and pass the fees through, or you can make them yourself.
• Get opt-in before you text. Your opt-in must name your business and say what you will send, how often, that message and data rates may apply, and that people can reply HELP for help and STOP to stop.
• Honor STOP and similar words at once, and answer HELP.
• Don’t use purchased, rented, shared or scraped lists, and don’t send content carriers restrict (such as sex, hate, alcohol, firearms or tobacco content) unless your approved campaign allows it.
• Send proactive texts only at reasonable hours in the recipient’s time zone, and within any narrower hours local law sets.
• In India, send only from DLT-registered headers using registered templates, to numbers scrubbed against Do Not Disturb preferences unless you hold registered consent. Because every SMS to an Indian number must match a registered template, AI agents cannot send free-form SMS replies to Indian numbers.

Carriers may filter or block messages, suspend registrations and charge fines for non-compliant traffic. You are responsible for fines caused by your messages.

5. Email

When your agents or sequences send email:

• Send only from domains and mailboxes you control, with accurate sender details and honest subject lines.
• Include your postal address and a working unsubscribe link in marketing emails, and honor unsubscribes within 10 business days (CAN-SPAM).
• Get consent before sending marketing email to individuals in the EU, the UK and other places that require it.

6. Website Chat Widget

If you add Finn’s chat widget to your website:

• Tell visitors in your privacy notice that chat conversations are processed by Finn on your behalf, and how long you keep them.
• Get any consent your local law requires for the identifier the widget stores in the visitor’s browser.
• Keep an AI disclosure in the conversation, and give visitors a way to reach a person.
• Don’t use the chat to collect full payment-card numbers, passwords or national ID numbers.

7. Rep Parallel Dialer

The Rep Parallel Dialer lets your representatives call several leads at once and connects the first person who answers. Many countries regulate this as automated dialing. The Dialer shows warnings — for example, outside calling hours, a lead marked do-not-call, or an attempt limit — but it does not block calls. You decide whom to call and when, and you must:

• Scrub your lists before you call against the National Do-Not-Call Registry (with your own subscription and a copy no more than 31 days old), the state lists that apply, and your own do-not-call list.
• Call only within the permitted hours at the called person’s location — in the US, 8 am to 9 pm under federal rules, with narrower hours and daily call limits in some states (for example, Florida, Oklahoma and Maryland end at 8 pm).
• Keep your abandoned-call rate within the limits that apply to you — in the US, no more than 3% of calls answered by a person, per campaign, measured over each 30-day period; in India, no more than 3% of attempted calls over 24 hours, with silent calls no more than 1%.
• Where the law requires a recorded message for an answered call that is not connected to a live representative within 2 seconds of the greeting — your business name, a phone number and a way to opt out — use only the Dialer modes and settings that play it, and set your business name and callback number before you call. Finn will tell you which modes play it.
• Let unanswered calls ring for at least 15 seconds or 4 rings.
• Use only caller IDs you own or are authorized to use, that people can call back during business hours to make a do-not-call request.
• Don’t use AI screening, an AI opener or a prerecorded voicemail drop on calls to mobile or residential numbers unless you have the consent the law requires — in the US, prior express written consent for marketing calls.
• Tell people at the start of a recorded call that it is being recorded. Some US states and many countries require every party’s consent.
• In India, make promotional calls only from 140-series numbers and service or transactional calls from 1600-series numbers where TRAI requires them (for example, for regulated financial entities), don’t use regular numbers (such as 080 or 022 landlines) for commercial calls to people who haven’t contacted you, be registered on DLT, declare your automated (A2P) calling and its number ranges to your operator where TRAI requires it, and respect people’s Do Not Disturb preferences.
• Keep your own records of calls, consent and do-not-call requests for as long as the law requires. Finn keeps Dialer records for the retention period in the Data Processing Addendum and is not your record-keeper.

Finn may lower your lines per representative, cap daily calls, or pause your Dialer access if drop rates, complaints, carrier warnings or other signs suggest unlawful calling.

8. Enforcement, Suspension and Disconnection

If you fail to provide the necessary consent artifacts within 24 hours of a request, or a regulator, carrier or Meta acts against your traffic, immediate enforcement action may be taken:

• Suspension and Number Reclamation: Your phone numbers (DIDs), sender registrations (such as 10DLC campaigns and DLT headers) and compliance applications may be suspended by our telecom partners or regulators, in India, the US, or Europe as applicable, and may be permanently reclaimed. Meta may restrict or disable your WhatsApp number or account. Finn may suspend the affected channel, the Dialer or your account.
• Zero Refund Policy: Finn accepts no liability, to the maximum extent permitted by law, for your failure to maintain compliance. No refunds, prorated credits, or financial compensation will be issued for accounts, wallet credit, usage, messages, Dialer usage, phone-number rental or other resources suspended due to regulatory or policy violations. Fees charged by Meta or carriers are not refundable by Finn.

9. Indemnification

You indemnify Finn (AIforge Tech Private Limited) against third-party claims, regulatory penalties, and fines or fees charged by carriers, registration bodies or Meta arising from your calls, messages, emails or telemarketing activities, as set out in the Indemnification and Limitation of Liability section of the Finn General Terms and Conditions.

10. The Disclosure Tools We Provide

Finn provides the disclosure mechanism; you provide the legal judgment. On AI calls, our two-party-consent “First Utterance” engine plays your recording and AI-disclosure language at the very start of the call, before the conversation proceeds — so the required disclosures are delivered consistently on every call you enable them for, and both the disclosure language and whether the call is recorded can be configured per jurisdiction in your workflow.

In chat — WhatsApp, website chat, SMS and email — your AI agent’s first reply in a conversation can tell the person they are talking to your business’s AI assistant, as you configure. On the Rep Parallel Dialer, a recording notice plays at the start of each call when recording is on.

Where the EU AI Act applies, Finn's disclosure tools — the First Utterance engine on calls and the AI disclosure in chat — are designed to support the transparency requirements of Article 50 by delivering AI-interaction disclosure at the start of each interaction as configured. You remain responsible, as the deployer, for enabling and configuring the disclosure language appropriate to each jurisdiction and use case.

During onboarding we pre-load a starter library of recording- and AI-disclosure scripts — templates for one-party and two-party-consent states, plus the artificial-voice line — into your workflow, so you adapt proven language with your counsel rather than drafting each jurisdiction from a blank page.

The scripts we pre-load are starting points, not legal advice. You warrant that each call’s script and each agent’s messages meet the recording and AI-disclosure requirements of the applicable jurisdiction, including two-party-consent recording states, GDPR transparency, and the EU AI Act’s Article 50 (see Section 2).

11. Uploading Your Own Contacts

By uploading contacts or lead lists — for AI calls, the Dialer, WhatsApp, SMS or email — you confirm that you have the consent or other legal basis needed to contact each person on that channel, under Sections 1 to 7 above. If you ask Finn to enrich a list with contact data, you are responsible for having a lawful basis to use the enriched data.

What you must not do:

• Upload phone numbers or email addresses you do not have permission to contact.
• Use uploaded lists for calls or messages the law does not allow — for example AI or prerecorded calls, SMS or WhatsApp messages without the consent the law requires — or for spam campaigns.
• Use purchased, rented, shared or scraped lists for SMS or WhatsApp.
• Ignore opt-out, Do-Not-Call, or do-not-disturb (DND) preferences, whichever registry applies in your region.

Best practices:

• Keep records of consent for each contact, including its source, the channel, the date and the wording shown.
• Record whether each number is a mobile or a landline, and whether it belongs to a business or a consumer.
• Respect opt-outs promptly, across every channel and every region you contact.
• Follow any additional local regulations that apply to your region — state, national, or EU-wide.

The summaries of regional regulations on this page are provided as guidance and do not constitute legal advice; consult your legal counsel in the relevant jurisdiction. The operational standards in Sections 1 through 11 are incorporated into the Finn General Terms and Conditions and form part of your agreement with Finn.