Security & privacy
Privacy laws & messaging rules
The rules that apply to messaging clients in Canada and the US, in plain words — and what the product does to help you follow them.
Important
This page is general information, not legal advice. You’re responsible for how your business contacts clients; if you’re unsure, ask a lawyer.
Canada
PIPEDA (privacy)
Canada’s federal privacy law for businesses. In short: collect only what you need, say why, keep it safe, and let people see or correct their information. You can export everything held about a client and erase it when asked.
Quebec Law 25
Quebec’s privacy law adds stronger duties: a person in charge of privacy at your business, telling people when data goes outside Quebec, and assessing that. Client messages are processed by service providers, some outside Canada (see Your data).
CASL (anti-spam)
Commercial messages — like comebacks — need consent. CASL allows implied consent for existing customers who bought from you in the last two years. That is the rule the product applies: comebacks go to Canadian clients with a completed visit in the last two years (or, for imported clients, a last visit under two years ago), and every message offers a way to stop. See Consent.
United States
TCPA and texting rules
US law and carrier rules require clear consent before sending marketing texts, honouring STOP immediately, and registering business texting (A2P 10DLC). The product honours STOP and similar keywords on every channel and doesn’t send comebacks without recorded marketing permission.
State privacy laws
Several states have consumer privacy laws with rights to access and delete data. The per-client export and erase tools cover those requests.
What the product does for you
| Rule | Built in |
|---|---|
| Stop means stop | STOP, UNSUBSCRIBE, BAJA and similar words switch messages off for that number on that channel, for everyone who shares it. |
| Stop in their own words | “Please stop texting me” (or “no me escriban más”) switches marketing off at once and hands the chat to your team to confirm the rest. The assistant never handles it. |
| Confirmed opt-in for texts | A number typed into a chat must reply YES to one confirmation text before it gets reminders by text. |
| Service vs. marketing | Reminders and comebacks are tracked separately; marketing needs its own permission. |
| Proof of consent | Every permission is recorded with where it came from and when. |
| Reasonable hours | Comebacks only 10:00–19:00 and not on Sundays by default; booking-change messages 08:00–21:00. |
| Not too often | At most 2 comebacks per client every 90 days, 21 days apart, by default. |
| Channel rules | WhatsApp’s 24-hour window and templates, Instagram’s 24-hour / 7-day limits. |
| Honest reviews | Every client gets the same review link — no “review gating”. |
| Honest AI | The assistant says it’s a virtual assistant when asked, and the chat page says messages are handled by AI. |
Note
Missing something your business needs? Email us — see the footer.