Communications Compliance Addendum

Effective October 1, 2026

This Communications Compliance Addendum applies to Corialto workflows that send or initiate SMS, email, automated calls, artificial-voice calls, missed-call text-backs, lead reactivation, nurture campaigns, review requests, or similar outbound communications.

1. Customer eligibility data

Customer must provide or maintain the records needed to determine who may lawfully receive each communication, including source, date, channel, consent language where required, relationship to Customer, opt-out status, and any applicable do-not-contact restrictions. Corialto may require this evidence before activating a workflow.

2. No purchased or unlawful lists

Customer may not use Corialto to send automated communications to purchased, scraped, harvested, or otherwise unlawful contact lists. Customer must not upload contacts when it lacks a lawful basis for the intended communication.

3. SMS and text messaging

Where required, workflows must identify the business, honor recognized opt-out requests, maintain suppression status, and avoid further non-exempt messages after opt-out. Customer is responsible for campaign registration or carrier requirements applicable to its traffic. Corialto may configure STOP, END, CANCEL, UNSUBSCRIBE, and QUIT handling and may add other keywords or controls.

4. Artificial or prerecorded voice

Customer must not initiate artificial/prerecorded voice calls without the level of consent, identification, and opt-out mechanism required for the intended call and jurisdiction. AI-generated human-sounding voice may be regulated as artificial voice. Customer must approve any required disclosure that the caller is interacting with an automated or AI-assisted system.

5. Email

Commercial email must use accurate sender and routing information, non-deceptive subjects, required commercial disclosures, a valid physical postal address supplied by Customer, and a functioning opt-out mechanism. Opt-out requests must be propagated to the applicable suppression list and honored within the legally required timeframe.

6. Quiet hours and jurisdiction rules

Customer must identify the jurisdictions and audiences it contacts. Corialto will configure reasonable send windows based on the approved requirements, but Customer remains responsible for any state, federal, industry, or contractual restriction that applies to its campaign.

7. Transactional vs. marketing messages

Appointment confirmations, requested callbacks, service updates, and similar operational messages may be treated differently from marketing. Customer must not relabel marketing content as transactional to avoid consent or opt-out requirements. Corialto may separate workflows by purpose.

8. Review requests

Review workflows must request genuine feedback from eligible customers without conditioning incentives on positive or negative sentiment. Workflows may not generate fake reviews, impersonate customers, misrepresent an independent review source, or use unlawful threats or deception to suppress negative reviews.

9. Records and audit trail

Customer should retain evidence of consent, campaign rules, message versions, opt-outs, suppression status, and eligibility criteria for a commercially reasonable period or longer when law requires. Corialto may store configuration evidence and workflow logs where supported.

10. Suspension

Corialto may pause or refuse a campaign when required consent evidence, opt-out controls, sender identification, physical address, or other material prerequisites are missing, or when Corialto reasonably believes the workflow creates legal, carrier, security, or reputation risk.

11. No legal advice

Corialto configures technical and operational controls but does not determine Customer's legal basis for a campaign. Customer should obtain qualified counsel for jurisdiction-specific advice.