Acceptable Use Policy

1. Scope

This Acceptable Use Policy (“AUP”) applies to every Customer, Authorized User and client-portal user of the Vora CRM platform (the “Service”). It is part of the Terms of Service and the Master Subscription Agreement. Capitalized terms have the meanings given in those documents.

The Dialer & Telemarketing Addendum and the SMS Terms contain more detail on calling and texting. If they set a stricter rule than this AUP, the stricter rule applies.

This AUP describes minimum standards. Following it does not by itself make a call, text or other activity lawful. The Customer remains responsible for its own legal compliance.

2. Consent for calls and texts

You must not place a call, leave a voicemail or send a text through the Service unless the Customer holds the consent the law requires for that contact. In particular:

• Telemarketing calls or texts using an autodialer, or any call using an artificial or prerecorded voice, require the Client's prior express written consent where 47 C.F.R. §64.1200 or a state law (such as Fla. Stat. 501.059) requires it.
• The consent must identify the Customer as the seller (by name) and cover the type of contact you are making.
• Marketing texts (for example, birthday or holiday messages) require marketing consent, not just consent to service messages.
• Consent revoked by any reasonable means, on any channel, ends consent on every channel. Inbound STOP replies and do-not-call requests are honoured across calls and texts.

You must not mark a lead as consented, enter consent details, or attach a consent certificate unless you hold genuine consent evidence for that Client.

3. Lead data

You must not upload or route lead data into the Service unless each lead comes with a consent record (for example, a TrustedForm, Jornaya or comply.support certificate) that names the Customer as the seller and shows the consent language, date, time and source. Leads without a valid certificate are held as “needs consent” and must not be dialed or texted until consent is confirmed.

You must not buy, rent, share or upload lead lists that were obtained unlawfully, or that were collected for a different seller, unless the consent expressly covers the Customer.

4. Do-not-call lists

You must not call or text a number that is on:

• the Customer's internal do-not-call list;
• the National Do Not Call Registry, unless an exemption genuinely applies (for example, an established business relationship or the Client's prior express written invitation) and the Customer has documented it;
• any applicable state do-not-call or no-sales-solicitation list; or
• a list of numbers that have opted out of texts.

You must not remove a number from a do-not-call list unless the Client has given valid new consent, and only through the Service's controlled removal (which requires an admin with step-up authentication). You must add a number to the internal list when a Client asks not to be called.

5. Calling hours and frequency

You must call and text only within the hours the law allows at the Client's location: not before 8:00 a.m. or after 9:00 p.m. local time under federal law, and within any narrower state window (for example, 8:00 a.m. to 8:00 p.m. in Florida and Oklahoma). Where the Client's time zone is uncertain, the most restrictive possible zone applies. Non-reply texts are sent only between 8:00 a.m. and 8:00 p.m. recipient local time.

You must respect state limits on how often you call (for example, Florida's limit of 3 calls in 24 hours on the same subject) and any frequency cap the Customer sets.

You must not change time-zone, address or state data on a lead to get around calling-hour or frequency checks.

6. Caller ID

You must not spoof caller ID or transmit misleading or inaccurate caller identification information (47 U.S.C. §227(e); 47 C.F.R. §64.1604). Calls must display a number the Customer is authorized to use and that a Client can call back to make a do-not-call request during regular business hours.

The caller name (CNAM) shown must be the name of the seller, meaning the Customer, not another agency and not Vora (except for Vora's own agency campaigns). You must not request numbers or caller names that impersonate a carrier, a government agency or another business.

7. Prerecorded, artificial and AI-generated voices

You must not use prerecorded messages, voicemail drops, artificial voices, AI-generated voices or voice clones on any call unless the Client has given prior express written consent to such calls and the message complies with the identification and opt-out requirements of 47 C.F.R. §64.1200(b). The FCC treats AI-generated voices as “artificial” voices under the TCPA. [COUNSEL: confirm whether a synthetic-voice abandon message or voicemail produced with a voice tool counts as an “artificial voice”, and the consent required.]

You must not clone or imitate the voice of any real person without that person's written permission, and never to impersonate a Client, a carrier, a government official or another agent. AI-cloned voices on live calls are not supported by the Service.

You must not disable, shorten or talk over the call-recording disclosure.

8. Medicare

You must not use the Service to make or send marketing, enrollment or referral calls or texts about Medicare Advantage, Medicare Part D or Medicare Supplement products, until the Customer and Vora have signed a separate addendum that enables Medicare features. The Service does not yet support CMS requirements such as scope-of-appointment records and Medicare call-recording retention.

9. Data the Service is not built to hold

You must not upload, paste or type into the Service (including notes, messages, custom fields, files and AI prompts):

• full Social Security numbers (only the last 4 digits are stored);
• full Medicare Beneficiary Identifiers (only the last 4 characters are stored);
• payment card numbers, card security codes, or bank account login credentials;
• health information beyond what a specific Service workflow requires (for example, the underwriting inputs a quote needs); never medical records, diagnoses or prescriptions in free-form notes;
• driver's licence or passport numbers, unless a Service field is designed for them; or
• passwords or one-time codes for any system.

If you find such data in the Service, delete it or ask your agency's admin to, and tell us if you need help.

10. Licensing

You must not work a lead, quote, solicit or take an application for a Client located in a state where you do not hold the required insurance licence (and, where required, the carrier appointment). You must keep your licence data in the Service accurate, and you must not enter licence data you do not hold or use another producer's account or licence.

11. Harassment, discrimination and unlawful content

You must not use the Service to:

• harass, threaten, abuse or deceive anyone, or make calls or send texts intended to annoy;
• discriminate unlawfully on the basis of race, colour, religion, national origin, sex, sexual orientation, gender identity, disability, age, marital status or any other protected characteristic, including unfair discrimination in insurance prohibited by state insurance codes (for example, in which Clients are offered products or how they are rated, contacted or served);
• make false or misleading statements about insurance products, carriers, premiums, benefits or government programs, or use unapproved advertising where carriers or law require approval;
• send content that is unlawful, defamatory, obscene, hateful, or that infringes anyone's intellectual property or privacy;
• send messages in prohibited content categories under carrier and 10DLC rules (for example, sex, hate, alcohol, firearms, tobacco or cannabis), or use shortened links that hide the destination; or
• commit or facilitate fraud, identity theft, premium diversion or any other crime.

12. Compliance gates, rate limits and security

You must not, and must not help anyone else to:

• circumvent, disable or interfere with the Service's compliance gates (consent, do-not-call, calling hours, frequency caps, licence checks, abandonment limits, opt-out handling) or recording disclosures, for example by dialing numbers manually outside the dialer to avoid a block, editing data to pass a check, or splitting campaigns to evade abandonment limits;
• exceed or evade rate limits, sending limits or usage limits;
• access accounts, workspaces or data you are not authorized to access, share your credentials, or bypass MFA or step-up authentication;
• probe, scan or test the vulnerability of the Service, except as section 13 allows;
• introduce malware, or interfere with or overload the Service or its providers;
• scrape, crawl or use automated means to extract data from the Service other than through APIs and exports the Service provides; or
• reverse engineer, decompile or disassemble the Service, or copy it to build a competing product, except as the law expressly permits.

13. Security testing and vulnerability reports

Security testing, penetration testing and load testing of the Service are allowed only with Vora's prior written permission, which sets the scope, timing and accounts to be used. Request permission at info@vorafinancial.io. Never test against another Customer's workspace or data.

If you find a vulnerability, report it to us promptly and privately, do not access more data than needed to show the issue, do not disclose it publicly until we have fixed it, and delete any data you obtained. We will not pursue legal action against good-faith reports that follow these rules.

14. Reporting violations

Tell your agency's admin and us at info@vorafinancial.io if you become aware of a violation of this AUP, including calls or texts without consent, a complaint from a Client, or a regulator or carrier inquiry. Report suspected security incidents or account compromise immediately to info@vorafinancial.io.

Anyone who received an unwanted call or text placed through the Service may reply STOP to a text, ask the caller to be placed on the do-not-call list, or contact us at info@vorafinancial.io or 786-654-1233, or Vora Financial LLC, 400 Sunny Isles Blvd, Sunny Isles Beach, FL 33160. We will pass the request to the agency responsible and make sure the number is blocked for that agency.

15. Enforcement

We may investigate suspected violations, including by reviewing account activity, call and message metadata and complaint records. The Customer will cooperate and provide consent evidence on request.

If we reasonably believe this AUP has been violated, or that a campaign, number or user puts Clients, carriers, our messaging registrations or the Service at risk, we may, with or without prior notice, take any of these steps, starting with the narrowest one that addresses the problem:

• pause a campaign or a dialing mode (for example, force a campaign to one-to-one dialing);
• suspend or release a phone number or a texting campaign;
• remove content or block specific leads or numbers;
• suspend a user's access;
• suspend the Customer's workspace; or
• terminate the account under the Terms of Service or the MSA.

Where practical, we will tell the Customer's admin what happened and what is needed to restore the service. We may report unlawful activity to carriers, messaging registries, law enforcement or regulators where the law requires or permits. Enforcement does not limit any other right or remedy we have.

We may update this AUP under the change process in the Terms of Service.