Skip to main content
Legal

SMS Compliance Policy

Last updated: March 15, 2026

This SMS Compliance Policy ("Policy") governs the use of SMS and text messaging features within Skode Flow and Skode CRM platforms ("Services") provided by Skode Technologies Private Limited("Skode," "we," "us," or "our"), a private limited company incorporated in India with registered office at Thirumangalath, Chelavur, Kozhikode – 673571, Kerala, India. All users who send SMS messages through our platform must comply with this Policy and all applicable telecommunications and data-protection laws.

Who sends the SMS. Skode provides the tools. When you use Skode Flow to send SMS, you(the customer) are the sender under applicable telecommunications and anti-spam law. You remain responsible for obtaining recipient consent, honouring opt-outs, registering with any required platforms (10DLC, TRAI DLT, short codes), and complying with the laws of your jurisdiction and your recipients’ jurisdictions. Skode does not route SMS through its own carrier accounts; your customer-connected SMS provider (for example, Twilio, Aircall, RingCentral, or Exotel) is the upstream carrier. See our Acceptable Use Policy and Anti-Spam Policy for platform-wide rules.

1. Purpose

This Policy ensures that all SMS messages sent through Skode comply with applicable laws and regulations across all jurisdictions where our customers operate. Failure to comply with SMS regulations can result in significant fines, legal action, and damage to both your business and our platform's reputation.

2. Applicable Laws

SMS messages sent through Skode must comply with all applicable laws, including but not limited to:

  • United States — TCPA:The Telephone Consumer Protection Act (47 U.S.C. § 227) regulates telemarketing calls, auto-dialed calls, pre-recorded calls, and text messages. Prior express written consent is required for marketing SMS. Violations can result in penalties of $500 to $1,500 per message.
  • United States — A2P 10DLC: Application-to-Person 10-Digit Long Code messaging requires brand and campaign registration with The Campaign Registry (TCR) and approval by mobile carriers. Carrier approval typically takes 1–2 weeks (5–10 business days).
  • United States — CTIA Short Code Monitoring Handbook:If you use a 5–6 digit short code for recurring campaigns, you must register and pass an operational review with the Common Short Code Administration (CSCA). Short-code approval typically takes 4–12 weeks.
  • United States — CAN-SPAM Act: If SMS messages are converted to email or sent through email-to-SMS gateways, CAN-SPAM applies (unsubscribe mechanisms, sender identification, and prohibition on deceptive headers and subject lines).
  • India — TRAI DLT Platform: The Telecom Regulatory Authority of India requires registration on a Distributed Ledger Technology (DLT) platform for all commercial SMS senders to Indian numbers. You must register your entity (Principal Entity), pre-register sender headers, and get every message template approved. Non-registered or non-template SMS is blocked by Indian telecoms. Registration typically takes 3–15 business days per template.
  • India — TRAI Commercial Communications Customer Preference Regulations 2018: You must honour the National Do Not Disturb (DND) / National Customer Preference Register (NCPR) for recipients who have opted out of commercial communications.
  • India — DPDPA 2023 & IT Act 2000:The Digital Personal Data Protection Act 2023 requires a lawful basis for personal-data processing, purpose-specific notice, and honouring of withdrawal. The Information Technology Act 2000 imposes additional obligations on commercial electronic messaging.
  • Canada — CASL & CRTC:Canada’s Anti-Spam Legislation requires express prior consent for marketing SMS. Penalties up to CAD 1.5 million for organisations.
  • Australia — Spam Act 2003:Prior express or implied consent for commercial SMS; working unsubscribe mechanism mandatory; penalties up to AUD 555,000.
  • European Union — GDPR & ePrivacy: Marketing SMS requires prior opt-in consent. The ePrivacy Directive (2002/58/EC) and national implementing laws provide the channel-specific rules; GDPR provides the data-protection floor.
  • United Kingdom — PECR Regulations 22–24:The Privacy and Electronic Communications (EC Directive) Regulations 2003, regulations 22–24, require prior express consent for marketing SMS. ICO enforcement up to £500,000.
  • United Arab Emirates — TDRA: The Telecommunications and Digital Government Regulatory Authority regulates commercial messaging, requiring sender registration and recipient consent.

3. Consent Requirements

Prior express written consent is required before sending any SMS message through Skode. Valid consent must meet the following requirements:

  • Clear and Conspicuous: The consent request must clearly and conspicuously disclose that the recipient is agreeing to receive text messages from your business.
  • Specific: Consent must be obtained for each specific type of message (marketing, transactional, alerts). Blanket consent is not sufficient.
  • Voluntary: Consent must not be a condition of purchasing goods or services. Pre-checked consent boxes are prohibited.
  • Documented:You must maintain records of consent including the recipient's phone number, the date and time consent was obtained, the method of consent (web form, keyword opt-in, paper form), the specific language presented to the recipient, and the IP address or other identifier (for online consent).
  • Message Frequency Disclosure:The consent disclosure must include the expected message frequency (e.g., "Up to 4 messages per month").
  • Cost Disclosure: The consent disclosure must state that message and data rates may apply.

4. Opt-Out Mechanism

Every SMS campaign must include a clear and functional opt-out mechanism:

  • Recipients must be able to reply with STOP (or UNSUBSCRIBE, CANCEL, END, QUIT) to immediately opt out of future messages.
  • Opt-out requests must be processed within 24 hours.
  • A confirmation message must be sent upon opt-out (e.g., "You have been unsubscribed. No more messages will be sent. Reply START to re-subscribe.").
  • No further messages of any kind (including opt-out confirmation follow-ups) may be sent after the confirmation message.
  • Opt-out information must be included in the first message of any new campaign and periodically thereafter (at least once per month for recurring campaigns).

5. Message Content Requirements

All SMS messages sent through Skode must include:

  • Your business name or brand identifier.
  • The purpose of the message (unless contextually obvious for transactional messages).
  • Opt-out instructions (e.g., "Reply STOP to unsubscribe").
  • A help keyword (e.g., "Reply HELP for support") for the first message.

6. Quiet Hours by Country

You must not send marketing SMS messages outside of the following permitted hours (local time of the recipient):

  • United States: Carrier-dependent; generally 8:00 AM to 9:00 PM local time. Some carriers enforce stricter windows. Skode recommends limiting marketing messages to 9:00 AM to 8:00 PM local time.
  • India: 9:00 AM to 9:00 PM IST. Promotional messages are prohibited outside these hours per TRAI regulations. Transactional messages may be sent at any time.
  • United Arab Emirates: 7:00 AM to 9:00 PM local time (GST). Marketing messages outside these hours may result in carrier penalties.
  • United Kingdom: 9:00 AM to 8:00 PM local time (GMT/BST). The ICO recommends avoiding early morning and late evening marketing messages.

Transactional messages (order confirmations, OTPs, security alerts) are generally exempt from quiet hours but should still be sent at reasonable times when possible.

7. Prohibited Content (SHAFT)

The following categories of content are strictly prohibited in SMS messages sent through Skode:

  • S — Stocks: Penny stock promotions, securities offerings, or investment advice.
  • H — Healthcare: Unapproved pharmaceutical products, unverified health claims, controlled substance offers.
  • A — Adult: Sexually explicit content, adult services, age-restricted content.
  • F — Finance: Payday loans, predatory lending, cryptocurrency scams, advance-fee fraud.
  • T — Tobacco/Cannabis: Tobacco, vaping, cannabis, or related products where prohibited.

Additionally, phishing links, malware, fraudulent content, hate speech, content promoting illegal activity, and gambling promotions (in restricted jurisdictions) are prohibited.

8. Sender Identification

All SMS messages must be sent from a properly registered sender ID. You must not spoof, falsify, or misrepresent the sender identity. Depending on the destination country:

  • US/Canada: Messages must be sent from a registered 10DLC number, toll-free number, or short code.
  • India: Messages must use a registered sender header (6-character alphanumeric ID) approved through the DLT platform.
  • UK: Alphanumeric sender IDs are permitted but must accurately identify your business.
  • UAE: Sender IDs must be registered with TDRA-approved aggregators.

9. Record Keeping

You must maintain records of all SMS-related consent and messaging activity for a minimum of 5 years (or longer if required by applicable law). Records must include:

  • Consent records (as described in Section 3).
  • Opt-out records with timestamps.
  • Message logs including content, recipient, timestamp, and delivery status.
  • Campaign registration documentation.
  • Complaint records and resolution actions.

Skode retains platform-level message logs for the duration of your subscription plus 90 days. You are responsible for maintaining your own consent records.

10. A2P 10DLC Registration (United States)

To send SMS messages to US recipients through Skode, you must complete the A2P 10DLC registration process:

  • Brand Registration: Register your brand with The Campaign Registry (TCR) through the Skode platform. This includes providing your business name, EIN/tax ID, address, and business type.
  • Campaign Registration: Register each use case (campaign) with a description, sample messages, consent flow details, and opt-out information.
  • Carrier Approval: Campaigns must be approved by mobile carriers before messages can be sent. Approval typically takes 3 to 15 business days.
  • Trust Score: Your brand trust score determines your throughput limits. Higher trust scores (based on business verification) allow higher message volumes.

11. India DLT Registration

To send SMS messages to Indian recipients, you must complete registration on the DLT platform operated by TRAI-authorized telecom operators:

  • Entity Registration: Register your business entity on the DLT platform with valid business documentation.
  • Header Registration: Register your sender headers (6-character alphanumeric IDs) for each brand or product line.
  • Template Registration: All message templates must be pre-registered and approved on the DLT platform before use. Templates include fixed and variable content sections.
  • Consent Registration: Consent records must be uploaded to the DLT platform for each recipient.

12. Enforcement

Violations of this Policy are addressed through graduated enforcement:

  • Warning: First violation results in a written warning with remediation steps and a 7-day compliance deadline.
  • Throttle: Repeated violations result in reduced sending limits.
  • Suspend: Continued non-compliance results in suspension of SMS sending privileges pending review.
  • Terminate: Egregious violations (TCPA violations, sending to DND numbers, phishing) may result in immediate termination of SMS capabilities and potential account termination.

13. Penalties

Non-compliance with SMS regulations can result in significant legal and financial consequences:

  • TCPA (US): $500 per unsolicited message, up to $1,500 per willful violation. Class action lawsuits are common.
  • TRAI (India): Disconnection of sender ID, blacklisting, and fines as determined by TRAI.
  • PECR (UK):Fines up to GBP 500,000 from the Information Commissioner's Office (ICO).
  • TDRA (UAE): Fines and suspension of messaging services.

You are solely responsible for any penalties, fines, or legal costs arising from your non-compliance with applicable SMS regulations. Skode may seek indemnification as provided in our Terms of Service.

13A. Browser Extension

This SMS Compliance Policy applies to SMS messages sent through any Skode Flow client, including the Skode Flow Chrome browser extension. TCPA, CTIA, 10DLC, DLT, and other regulatory requirements described above apply identically regardless of which Flow client sent the message. See our Extension Privacy Notice for extension-specific data handling.

14. Contact Information

If you have questions about this Policy or need assistance with SMS compliance, please contact us: