A2P Privacy Policy and Terms of Service Recommendations

Prev Next

Creating robust privacy policies and terms of service is essential for any Application-to-Person (A2P) messaging program. These documents build customer trust, ensure legal compliance, and protect your brand. They must also be easily accessible, transparent, and consistent with your messaging practices.

Creating a clear and comprehensive privacy policy and terms of service is a critical step for any business engaging in Application-to-Person (A2P) messaging. While specific requirements may vary between companies and jurisdictions, these recommendations are widely followed as industry best practices to ensure compliance and build customer trust.

By following these guidelines, you can help ensure your A2P messaging program is compliant and transparent, fostering trust with your customers.

Important Note

It is important to remember that these are guidelines, not legal mandates, and they should be adapted to fit your specific business needs. We strongly recommend that you consult with your leadership and legal counsel to determine the exact content and wording that should be included in your company's official policies.

Let’s dive in!

Privacy Policy Recommendations

Having a compliant Privacy Policy is essential for A2P messaging. A privacy policy explains how you collect, use, and protect a user's data. For A2P messaging, it must be particularly clear about how mobile information is handled.

Data collection transparency

Your policy should clearly state what information you collect (e.g., phone numbers, message content, opt-in data) and for what purpose (e.g., sending alerts, marketing, customer service). See an example below.

Example of Data collection transparency wording

Information We Collect and Why We Collect It

We collect personal data to operate our business and provide you with our services. We only collect the information that is necessary for the purposes outlined in this policy.

The types of personal information we collect, and our reasons for collecting it, are described below:

  • Information You Provide to Us Directly

    We collect information that you voluntarily provide to us when you use our services. This includes:

    • Account and Profile Data: When you create an account, we collect your name, email address, and password.

      • Purpose: This information is necessary to set up your account, authenticate you, and provide you with access to our services.

    • Customer Support Information: If you contact our support team, we collect your name, email address, and the content of your communication.

      • Purpose: To respond to your inquiries and provide customer support.

    • Transaction Data: If you make a purchase, we collect your payment information and billing details.

      • Purpose: To process your transaction and fulfill your order.

  • Information We Collect Automatically

    When you use our website or services, we automatically collect certain information about your device and your activity. This includes:

    • Usage Data: We collect information about how you interact with our services, such as the pages you visit, the links you click on, and the time and duration of your visit.

      • Purpose: To analyze and improve the performance of our website and services.

    • Device Information: We collect information from the device you use to access our services, such as your IP address, browser type, operating system, and unique device identifiers.

      • Purpose: To secure our services, prevent fraud, and ensure the correct display of our content.

  • Information We Receive from Third Parties

    We may receive information about you from third-party sources. For example, if you log in to our service using a social media account, we may receive your public profile information from that service.

    • Purpose: To streamline the account creation process and enhance your user experience. We will only use this information in accordance with the third party's privacy policy and your privacy settings on that service.

  • Cookies and Other Tracking Technologies

    We use cookies and similar tracking technologies to track the activity on our services and store certain information. Cookies are small data files stored on your device. We use them for several purposes:

    • Strictly Necessary Cookies: These are essential for the operation of our website (e.g., to remember items in your shopping cart).

    • Analytics and Performance Cookies: We use these to understand how visitors use our website, which helps us to improve its functionality.

    • Targeting and Advertising Cookies: These are used to deliver advertisements that are more relevant to you and your interests.

    You can learn more about how to manage your cookie preferences in our separate [Cookie Policy Link] or by adjusting your browser settings.

No Sharing or Selling Mobile Data

This is a critical point. Your policy must explicitly state that you will not sell or share mobile information, including opt-in data and consent, with third parties or affiliates for marketing or promotional purposes. While you can share data with subcontractors for support services like customer service, this must be clearly outlined.

Example of No Sharing or Selling Mobile Data wording

“No mobile information will be shared with third parties/affiliates for marketing/promotional purposes.”

Permitted Sharing

Sharing information with subcontractors for essential support services, such as customer service, is allowed. Being specific about what services these are helps create transparency and trust with customers. See the example below.

Example of Permitted Sharing wording

We may share your personal information with the following categories of third parties for the purposes described below:

  • Service Providers: We engage trusted third-party service providers to perform functions and provide services to us. We may share your personal information with these providers to facilitate our services, such as:

    • Cloud Hosting Services: To store your data securely.

    • Payment Processors: To process your transactions.

    • Analytics Providers: To help us analyze how our services are used and improve them.

    • Customer Support Platforms: To assist with your support inquiries. We only share the minimum amount of information necessary for the service provider to perform its function, and these parties are contractually obligated to protect your data.

  • Affiliates and Corporate Partners: We may share your information with our affiliated companies, which are under common ownership or control. This is to help us provide you with a unified and consistent service. We may also share information with trusted business partners to provide you with joint products or services.

  • Legal and Regulatory Disclosures: We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court order or subpoena), to protect our rights, or to protect the safety of our users or the public.

  • Business Transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, your personal information may be transferred to the acquiring entity. We will notify you via email or a prominent notice on our website of any such transfer and any choices you may have regarding your information.

  • With Your Consent: We may share your information with other third parties when we have your explicit consent to do so.

  • For Marketing and Advertising: We may share certain information, such as your email address (in a hashed format), with third-party advertising partners to deliver targeted advertisements to you. You have the right to opt-out of this sharing. Please refer to the "Your Privacy Rights" section for more details.

Data Security

Detail the security measures you have in place to protect user data from unauthorized access, loss, or misuse. Mention both technical and organizational safeguards. See some examples below.

Example of simple Data Security wording

We take the security of your personal information very seriously and have implemented reasonable physical, technical, and administrative safeguards to protect your data from unauthorized access, use, or disclosure. However, please be aware that no method of transmission over the Internet, or method of electronic storage, is 100% secure.

Example of detailed Data Security wording

We are committed to protecting the security of your personal data. We have implemented a range of appropriate technical and organizational measures to protect your information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

These measures include:

  • Encryption: We use industry-standard encryption protocols (like SSL/TLS) to protect data both in transit and at rest.

  • Access Controls: Access to your personal data is restricted to employees, contractors, and agents who need to know that information to perform their job duties. They are subject to strict confidentiality obligations.

  • Firewalls and Monitoring: We use firewalls and continuous monitoring to detect and prevent unauthorized access to our systems.

  • Regular Audits: We conduct regular security assessments and audits to ensure the effectiveness of our safeguards.

Important Note: While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security. The security of your account also depends on your own actions, such as choosing a strong password and not sharing it with others.

In the Event of a Data Breach: We have established procedures to handle any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Data Retention

Specify how long you will retain a user's data and the criteria for disposing of it. See an example below.

Example of Data Retention wording

We will retain your personal information only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your information to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies.

User Rights

Outline the rights a user has regarding their personal information, such as the right to access, correct, or delete their data. Provide clear instructions on how they can exercise these rights. See an example below.

Example of User Rights wording

Your Privacy Rights

We believe you should have control over your personal data. Below is a summary of the key rights you have under data protection laws. To exercise any of these rights, please contact us at [email address].

  • Right to Know and Access: You have the right to request a copy of the personal information we hold about you. This includes information about what data we collect, why we collect it, and who we share it with.

  • Right to Correction: You have the right to ask us to correct any personal information you believe is inaccurate or incomplete.

  • Right to Deletion (Right to be Forgotten): You have the right to request that we delete your personal data. We will fulfill this request unless we are required to retain the data by law.

  • Right to Opt-Out of Data Sharing/Sale: You have the right to direct us not to share or "sell" your personal information with third parties. To exercise this right, please click [insert "Do Not Sell My Personal Information" link here].

  • Right to Object to Processing: You have the right to object to our processing of your personal data for certain purposes, such as direct marketing.

  • Right to Data Portability: You have the right to request that we provide you with your personal data in a structured, commonly used, and machine-readable format.

  • Right to Withdraw Consent: If we are processing your personal data based on your consent, you have the right to withdraw that consent at any time.

How to Exercise Your Rights

To exercise any of your privacy rights, please submit a verifiable consumer request to us by:

  • Emailing us at: [email address for privacy inquires to your company]

  • Calling our toll-free number: [Your Phone Number]

Your request must include sufficient information to allow us to reasonably verify that you are the person about whom we collected personal information. We will respond to all legitimate requests within 30 days of receiving your request. Please note that we may ask you to provide additional information to confirm your identity before processing your request.

Policy Updates

Include a statement about how and when the policy may be updated and how users will be notified of these changes. See an example below.

Example of Policy Updates wording

We reserve the right to modify this Privacy Policy at any time, in our sole discretion. Any changes to this policy will be effective immediately upon being posted on this page, with an updated "Last Updated" date at the top.

We will provide notice of any material changes to this policy by sending an email to the primary email address specified in your account, or by placing a prominent notice on our website. Your continued use of the Service after the effective date of the revised policy constitutes your acceptance of the terms.

If you do not agree with the terms of the revised policy, you should stop using our services and, if applicable, delete your account.

Contact Information

Provide a dedicated point of contact for users to ask questions or raise concerns about their privacy. It creates a clear channel for communication and empowers individuals to exercise their rights regarding their personal data. This can be whichever preferred method you want as your point of contact for this topic, such as an email address or a phone number.

Accessibility

The Privacy Policy should be publicly available and easily found so users aren’t searching endlessly. It is a fundamental requirement for businesses to operate legally, build trust with their customers, and protect against significant financial and reputational risks.

Note

The policy can be linked in the footer of your website, if you choose.

Terms of Service Recommendations

Your terms of service (ToS) form the agreement between you and the user. For A2P, it's particularly important to focus on consent and message management.

Explicit Consent

The ToS should detail your consent-based opt-in process. This includes how users give their express permission to receive messages (e.g., through a web form, keyword, or in-store sign-up). See some examples below:

Examples of Explicit Consent wording

  • "By clicking this box, you acknowledge that you have read, understood, and agree to our [Link to Terms of Service] and [Link to Privacy Policy]."

  • "We use your email address to send you marketing and promotional offers. By checking this box, you consent to receive these communications. You may unsubscribe at any time."

  • "By using our service, you agree to the following:

    • You are at least 18 years of age.

    • You have read and agree to our [Link to Terms of Service].

    • You consent to our collection and use of your personal data as described in our [Link to Privacy Policy]."

Important Note

Consent shouldn’t be implied. It is strongly recommended to never use pre-checked boxes for consent.

Opt-Out Instructions

This is non-negotiable. Provide clear, easy-to-follow instructions on how users can opt out of the service at any time. Your ToS should specify the standard keywords you'll respect, such as STOP, CANCEL, UNSUBSCRIBE, QUIT, and END. You should also mention that you'll send a final confirmation message upon an opt-out request, but no other messages after that.

For more information about opt-out, read this Help Center article.

Opt back in (Rejoining)

An Opting Back In (Rejoining) clause for a terms of service document should be clear, specific, and user-friendly. It explains what the user is re-enrolling in, what the consequences are, and how they can do so easily. Some examples below.

Example of simple Opt Back In wording

Re-enrolling in the [Program Name] Program

If you previously opted out of the [Program Name] Program, you can choose to re-enroll at any time. To do so, simply visit your account settings page and click the "Re-enroll" button. By re-enrolling, you agree to the current terms and conditions of the [Program Name] Program, which can be found in full at [link to full terms]. Your re-enrollment will be effective immediately, and you will once again be eligible to [list key benefits, e.g., "earn loyalty points" or "receive special offers"].

Example of detailed Opt Back In wording

Consent to Re-enrollment

You may, at your discretion, re-enroll in the [Program Name] Program after opting out. Your re-enrollment constitutes your express consent to be bound by all of the terms and conditions of this Agreement, as amended from time to time.

To re-enroll, you must log in to your account and complete the re-enrollment process as instructed. By proceeding, you acknowledge that you have read, understood, and agreed to the terms governing the [Program Name] Program. You understand that your re-enrollment is voluntary and that you are under no obligation to re-join. Upon successful re-enrollment, the terms of this Agreement will apply to your participation going forward.

Message Details

Be transparent about the messaging program and what’s included in it. This includes:

  • Program Name and Description: Clearly identify the sender and the types of messages a user can expect.

  • Message Frequency: Disclose the expected frequency of messages, whether it's "4 messages per month" or "message frequency varies."

  • "Message and Data Rates May Apply": Include this standard disclaimer to inform users of potential charges from their mobile carrier.

Prohibited Content

State clearly that you will not engage in sending illegal, misleading, or deceptive content. This can include, but is not limited to, content related to hate speech, fraud, or illicit goods.

For more information about prohibited content, read this Help Center article.

Disclaimers

Include a disclaimer that carriers are not liable for delayed or undelivered messages. This helps in managing user expectations and limiting the company's liability for factors beyond its control. The key is to be clear and direct about the limitations of the service. See some examples below.

Examples of Disclaimer wording

"AS IS" and "AS AVAILABLE" Disclaimer

The Service is provided on an "AS IS" and "AS AVAILABLE" basis. We make no representations or warranties of any kind, whether express, implied, or statutory, regarding the Service. To the fullest extent permitted by law, we expressly disclaim all warranties, including but not limited to, warranties of merchantability, fitness for a particular purpose, and non-infringement. We do not warrant that the Service will be uninterrupted, error-free, or secure, or that any defects will be corrected.

Disclaimer of Liability for Service Interruption

We are not liable for any delays, interruptions, or failures of the Service caused by factors beyond our reasonable control, including but not limited to, natural disasters, acts of government or military, acts of public enemies, war, riots, strikes, power outages, network outages of third-party providers, or equipment failures. We will make reasonable efforts to restore the Service as soon as practicable.

Third-Party Services and Content Disclaimer

The Service may allow you to access or use services, content, or websites provided by third parties. We are not responsible for the content, privacy policies, or practices of any third-party services or websites. You acknowledge and agree that we shall not be responsible or liable, directly or indirectly, for any damage or loss caused or alleged to be caused by or in connection with the use of or reliance on any such third-party content, goods, or services.

Compliance with Industry Standards statement

Having a Compliance with Industry Standards clause in a terms of service document helps manage expectations and protects the company by making it clear that both parties are expected to adhere to specific, recognized standards. See an example below.

Example of Compliance with Industry Standards wording

Compliance with Industry Standards

You agree to use the Service in compliance with all applicable local, state, national, and international laws and regulations. You further agree that your use of the Service, and any content or data you provide, shall at all times comply with the generally accepted practices and standards of the [Your Industry] industry, including but not limited to, [mention specific standards, e.g., HIPAA for healthcare, PCI DSS for e-commerce, or relevant data security frameworks].

We warrant that the Service will be provided in a professional and workmanlike manner, in accordance with the standards of care and skill generally observed by reputable providers of similar services. Our commitment to these standards is in addition to, and not a replacement for, any specific legal or regulatory obligations that we must meet.

You acknowledge that our compliance with these standards is conditional on your adherence to the acceptable use policies and other terms set forth in this Agreement. We reserve the right to audit your usage and, in the event of any non-compliance, to suspend or terminate your access to the Service.

Legal Compliance Note

A Legal Compliance Note in a terms of service document outlines the user's and the company's responsibilities to comply with the law. It sets a clear expectation that the service will not be used for illegal activities and helps protect the company from liability.

Example of general Legal Compliance Note wording

Compliance with Laws

You agree to comply with all applicable laws, regulations, and rules in connection with your use of the Service. You are solely responsible for ensuring that your use of the Service is in compliance with all relevant laws and for any content you provide. You may not use the Service for any unlawful or prohibited purpose. We reserve the right to investigate and take appropriate legal action against anyone who, in our sole discretion, violates this provision, including without limitation, reporting you to law enforcement authorities.

Example of detailed Legal Compliance Note wording

Legal and Regulatory Compliance

You represent and warrant that your use of the Service will comply with all applicable federal, state, and local laws, rules, and regulations, including but not limited to, those governing data privacy and security, intellectual property, advertising, and consumer protection. You agree to use the Service in accordance with all relevant industry standards and best practices.

We reserve the right, but have no obligation, to monitor your use of the Service and the content you provide to ensure compliance with this Agreement and applicable laws. In the event of any suspected violation, we may, in our sole discretion, suspend or terminate your account and report the matter to the appropriate authorities.

Example of simple Legal Compliance Note wording

Your Obligations

By using our Service, you agree to abide by all applicable laws and regulations. You are responsible for ensuring that your actions do not violate any laws. Any use of the Service for illegal activities is strictly prohibited.

Consistency

The information in your ToS and Privacy Policy must be consistent with all your promotional materials, opt-in forms, and sample messages.

Help Instructions

Provide clear instructions for users to get assistance, such as replying with HELP or providing a customer support contact.

For more information about Help instructions, read this Help Center article.

Transparency

The language should be simple and easy to understand. Avoid using misleading or deceptive promotions to gain consent.

Accessibility

The Terms of Service document should be publicly available and easily found so users aren’t searching endlessly. It is a fundamental requirement for businesses to operate legally, build trust with their customers, and protect against significant financial and reputational risks.

Note

The document can be linked in the footer of your website.

More information

For additional information, check out these articles: