Safety & Compliance

TCPA

Compliance And Communications Acceptable Use Policy

Company: I REVLAB, INC.
Covered Services: DEOS™, REVLAB VIDEO™, and covered legacy REPLAi™ products and services
Author: DEOS Engineering, Management, and Legal Departments
Last Updated: November 4, 2026

01. Scope, Application, And Relationship to User Agreements

This TCPA Compliance And Communications Acceptable Use Policy (the “Policy”) governs the use of the covered automotive engagement platform, software, APIs, agents, and communication services provided by I REVLAB, INC. (“Company,” “DEOS,” “we,” “us,” or “our”) to initiate, generate, schedule, transmit, or support consumer communications.

The Policy applies to dealerships, dealership groups, service and repair businesses, OEMs, agencies, other approved business customers, and their authorized users (“Customer” or “you”). Covered communications include SMS, MMS, AI-generated and other artificial or prerecorded voice calls, interactive voice response, automated follow-up, and related lead-capture and consent workflows (“Communications”). Applicable requirements also extend to staff-directed activity through the Services. A human click, a manual mode, or a business contact label does not itself establish an exemption.

Paid subscriptions, pilots, trials, free access, beta services, and legacy offerings are subject to the requirements applicable to their enabled use. No evaluation entitlement authorizes live outreach without the required controls and permissions.

When validly incorporated, this Policy supplements the DEOS Product And Services Subscription Terms And Conditions (“Subscription Terms”), applicable Order, Privacy Policy, and any controlling addendum (together, the “Agreement”). It does not silently override their document priority, liability limitations, indemnity procedures, termination rights, or individual privacy protections. Publication alone is not a substitute for a legally sufficient customer acceptance or amendment process.

Customers must comply with applicable law, including the Telephone Consumer Protection Act, 47 U.S.C. § 227 (“TCPA”), FCC rules, the FTC Telemarketing Sales Rule (“TSR”), applicable do-not-call, recording, privacy, consumer-protection, and state telemarketing requirements. Carrier and messaging-provider requirements apply separately from law. The authorities and resources are linked in Section 20.

A permitted platform action is not proof that a communication is lawful. Customer authorization cannot waive a consumer's rights or excuse Company's own legal duties.

02. Shared Responsibility And Accountable Operation

2.1 Customer Responsibilities

Customer directs its business communications and is responsible for the lawfulness and accuracy of its source records, offers, audiences, campaign purposes, consent evidence, approved content, and instructions. Customer must identify the actual dealership or seller for each campaign, maintain an accountable compliance contact, and provide properly authorized personnel and escalation coverage.

Customer must obtain required permissions before outreach; provide legally required notices; maintain applicable registrations, licenses, and do-not-call access; and promptly communicate opt-outs, wrong-number reports, and corrections received outside DEOS. These duties extend to agencies and other users acting for a dealership. They cannot transfer consent between independently operated businesses merely because they share a brand or group.

2.2 Company Responsibilities

Company must exercise reasonable care in implementing and operating the agreed communication controls and perform its own applicable legal and contractual obligations. Required controls include permission checks, suppression handling, approved sender identification, configured time and frequency limits, controlled agent authority, appropriate records, and mechanisms to pause affected activity.

DEOS may generate content, evaluate eligibility, schedule work, and execute authorized actions. Accordingly, the Services are not characterized as an exclusively passive conduit. Whether a party is a caller, initiator, seller, telemarketer, sender, agent, or other responsible participant depends on the facts and applicable law; this Policy does not conclusively assign those legal statuses or immunize either party.

2.3 Required Activation Controls

Sections 3–15 establish required operating standards, not a representation that every described integration is available in every deployment. A live feature may be activated only after its applicable controls, provider configuration, permissions, and test results have been approved. If a required control is unavailable or fails, affected outreach must remain disabled or be paused; it must not fall back to an uncontrolled route.

Required restrictions must be enforced in the execution path, including APIs, agents, scheduled work, and retries; a disabled interface button alone is insufficient. Ordinary users must not be able to bypass them. Any approved operational exception must be authorized, recorded, and lawful and cannot manufacture missing consent or override a binding consumer restriction.

03. Classifying Communications Before Launch

The substance, context, recipient, technology, and purpose determine the applicable requirements. A campaign label such as “service,” “retention,” “goodwill,” or “customer care” does not decide its legal classification.

A notice that a vehicle is “due for service,” a declined-service recovery campaign, or a lease-end message can encourage a new purchase. It must not automatically be treated as transactional merely because it relates to an existing customer or vehicle. Routine recall outreach is not automatically an emergency exemption.

Where classification is uncertain, use the more protective marketing standard or hold the communication for review. An agent must not convert an informational exchange into an upsell without the required permission and approved workflow authority.

04. Consent Requirements And Proof

4.1 Prior Express Consent For Nonmarketing Communications

For covered informational calls or texts, Customer must establish the required prior express consent (“PEC”) or a specifically approved applicable exception. A consumer's provision of a number can support consent for communications within the reasonably understood purpose for which it was supplied, depending on the facts and law. It is not unlimited permission for every department, purpose, channel, or future campaign.

A number on a repair order, financing application, or historical CRM record does not alone prove permission for unrelated follow-up. Customer must consider who supplied the number, any restrictions, the requested transaction, later revocation, ownership changes, and the proposed contact. Providing a mobile number for a limited purpose does not create marketing consent.

For a consumer-requested informational text, retain the request and requested scope. For a previously unverified number in the limited assistant-SMS program, complete the configured number-verification process before sending further requested information. Verification establishes control of a number; it does not establish marketing consent.

4.2 Prior Express Written Consent For Automated Marketing

For the marketing covered by Section 3, Customer must obtain prior express written consent (“PEWC”) through a clear, conspicuous, signed agreement, including a legally valid electronic signature where appropriate. The agreement must identify the authorized seller, the telephone number, the permitted communications and technology, and disclose that consent is not a condition of purchasing property, goods, or services.

The disclosure must be presented at the point of assent. It cannot be hidden in a Privacy Policy, inferred from chat entry, preselected, supplied by an employee on the consumer's behalf, or bundled into an indistinguishable general acknowledgment. A web checkbox is evidence only when the actual disclosure, affirmative action, attribution, and surrounding process support a valid agreement.

DEOS requires consent identifying the particular dealership or seller. Generic permission for unspecified “partners,” an OEM brand alone, or every affiliate is insufficient under this Policy. Providers acting only on that seller's behalf do not receive independent marketing rights. The dealer-specific platform standard is not a claim that the FCC's vacated 2023 one-to-one-consent rule remains in effect; the January 24, 2025 appellate decision is linked in Section 20.

4.3 Consent Evidence

The consent record must be sufficient to reproduce and explain the permission relied on. As applicable, retain:

• Consumer and telephone-number association; actual named seller; channel; and permitted purpose.
• Exact disclosure text and version, the rendered presentation or a reliable reproducible copy, and the relevant form or source URL.
• Date, time, time zone, affirmative action or signature, and appropriate session or source identifiers.
• IP address and relevant device/session evidence where lawfully collected and useful; these alone do not establish identity or consent.
• Source, any authorized intermediaries, verification events, later restrictions, revocations, and renewed consent.

Customer must not rely solely on a CRM field marked “opted in,” a vendor certificate, a screenshot of a different form, or an unverifiable timestamp. Evidence must correspond to the actual recipient, seller, disclosure, and action. Records must be access-controlled and protected against unauthorized alteration, with traceable corrections; the Policy does not claim that records are technically unalterable.

05. Permitted Sources, Prohibited Lists, And Dealer Separation

Customer may use direct dealership opt-ins and authorized source records only to the extent their permission supports the intended communication. The existence of a DMS/CRM connection is not a consent determination.

The following are prohibited for DEOS outbound campaigns:

• Purchased, rented, scraped, harvested, generated, or broker-supplied telephone lists.
• Shared or co-registration databases offering generalized consent to unspecified businesses.
• Records supplied by an agency, OEM, dealer group, or another dealership without verifiable authority for the actual seller and proposed outreach.
• Any source whose permission cannot be substantiated or whose restrictions, provenance, or number ownership are materially uncertain.

A third-party system transmitting a direct lead specifically submitted to the identified dealership is not automatically a prohibited purchased list. It requires Company approval of the source and a verifiable original consent/request chain. Approval of the connector does not approve every lead it delivers.

Consent and suppression evidence remain protected within the appropriate dealership environment. No customer-level cross-dealer identity matching, audience pooling, or reuse is authorized. Where a broader group or affiliate opt-out must be honored, apply the necessary restriction through an authorized, minimum-data compliance process; it does not create cross-dealer marketing permission or general DDU access.

06. Do-Not-Call And Seller Identification Controls

Customer must comply with applicable national, state, and seller-specific do-not-call requirements. Before covered telemarketing, the responsible parties must obtain the required registry access and apply an appropriately current registry check. Where the federal 31-day refresh requirement applies, the screening process must meet it. A campaign must also check the dealership's own suppression records at execution.

A claimed established-business-relationship or written-permission exception requires documented eligibility. It does not override a seller-specific do-not-call request, supply missing artificial/prerecorded-voice marketing permission, or automatically cover affiliates. An existing customer is not categorically exempt from communication rules.

Calls and texts must accurately identify the dealership or seller. Caller ID must use an authorized number and truthful identification; impersonation, deceptive local-presence spoofing, and rotation of numbers to evade blocking or suppression are prohibited. The dealership must provide a functioning contact route and personnel capable of addressing communication concerns.

Do-not-call and revocation controls must cover applicable users, agents, departments, campaigns, and sending numbers. Moving a record to another salesperson, channel provider, account, or campaign cannot erase a restriction.

07. Messaging Registration And Carrier Requirements

Before application-to-person SMS/MMS traffic is enabled, Customer and Company must complete the registration or verification required for the chosen sender type and provider. For U.S. 10-digit long-code traffic, this generally means approved A2P 10DLC brand and campaign registration and the correct association of sending numbers. Toll-free and short-code traffic have their own applicable verification or approval processes; 10DLC is not a universal registration system for every message type.

Customer must provide accurate business identity, campaign use cases, sample messages, opt-in flows, support information, and required customer-facing policies. Traffic must remain within approved uses and capacity. Customer must cooperate with carrier inquiries and must not split, disguise, or reroute traffic to avoid controls.

Carrier approval, verification, registration, or delivery does not establish legal consent or government approval. CTIA principles and provider policies are industry requirements, not statutes, although they may impose enforceable conditions on access and delivery. Company may hold or suspend traffic that lacks required approval or triggers a credible provider-compliance concern.

08. Contact Times, Frequency, And Queue Controls

8.1 Recipient-Local Time

The default DEOS window for scheduled automated outbound campaigns is 9:00 a.m. to before 8:00 p.m., at the recipient's location. This is a Company operating standard, not a statement that federal law imposes that exact window on every communication. Applicable narrower hours, restricted days, holidays, frequency limits, and consumer-specific restrictions control.

Federal solicitation rules generally use an 8:00 a.m.–9:00 p.m. recipient-local window, while some covered state solicitation rules are narrower. Florida, Oklahoma, Maryland, and other jurisdictions require use-case-specific assessment. No single time window establishes compliance with all state laws.

Recipient location must be assessed using reliable available information. Area codes and billing addresses are indicators, not proof of present location. Where reasonably supported locations conflict, use a window permitted in each applicable location or hold the outreach. Customer must supply known corrections and restrictions. Daylight-saving changes and delayed queues must be addressed.

An immediate response to a consumer's specific request, an inbound conversation, or a genuine permitted urgent operational communication may require different handling. Any exception must be purpose-limited, approved for the workflow, and lawful; it is not permission to launch a promotional campaign after hours.

8.2 Frequency And Execution

Each campaign must have approved contact and retry limits, with coordination across dealership departments and campaigns. Apply any stricter statutory limit; do not treat a maximum allowed by law as a recommended contact schedule. Repeated attempts must not become harassment.

Before each send or dial attempt, recheck consent, suppression, time, jurisdiction, number status, frequency, and campaign eligibility. Deferred work must be checked again when released. Duplicate events, failed callbacks, and retries must not generate duplicate outreach or circumvent a limit. If a required check is unavailable, hold the affected communication.

09. Revocation, Opt-Outs, And Suppression

9.1 Accepted Requests

DEOS accepts clear requests to stop covered communications through reasonable available methods, including reply texts, verbal requests during calls, designated telephone or website routes, and requests made to dealership personnel or Company support. Customers must promptly record requests received outside the platform and transmit them to the agreed suppression process. DEOS does not make a consumer's use of one exclusive method a condition of honoring a clear request under this Policy.

The SMS workflow must recognize STOP, QUIT, END, REVOKE, OPT OUT, CANCEL, and UNSUBSCRIBE, without requiring exact capitalization, and address other language reasonably conveying revocation. Ambiguous messages must be reviewed or conservatively held, not treated as continued permission to market.

Voice workflows must recognize clear requests such as “stop calling,” “take me off your list,” or “do not contact me again,” and provide the configured voice and/or keypress opt-out. Once the recipient uses the automated call opt-out, the system must record the applicable restriction and end the call without another sales pitch. Do not require a transfer, login, explanation, or payment to opt out.

9.2 Timing And Scope

Supported automated opt-outs must be processed without intentional delay and must block affected future attempts, including queued work, before another such attempt is released. Requests requiring manual handling must be actioned promptly, with affected outreach held while resolved. Applicable legal deadlines are outer limits, not a permission to keep sending until the deadline. The federal rules discussed in Section 19 presently retain a reasonable-time requirement capped at ten business days for covered revocations; a shorter applicable rule controls.

Apply a request according to its expressed scope and governing requirements:

Provider-level blocking can be broader than the consumer's original program. Do not promise continuation of another category where the sender or carrier will block it. A legal change permitting narrower category treatment does not automatically reduce an existing broader request or revive withdrawn consent.

9.3 Confirmations And Renewed Permission

A permitted confirmation must be limited to acknowledgment or legally permitted clarification, contain no marketing, and follow applicable timing and provider rules. DEOS permits no more than one nonpromotional confirmation of the same request. Do not delay suppression awaiting a reply. A confirmation is not a re-enrollment solicitation.

START or another resubscription request may remove a technical block only through the approved process. It does not automatically recreate PEWC for calls and texts beyond the request's valid scope. Renewed marketing permission must meet the applicable consent standard and must be documented. Reimporting an old list or changing a phone field is not renewed permission.

10. Wrong Numbers And Reassigned Numbers

Consent belongs to the consenting person and does not transfer to a new subscriber merely because the telephone number is unchanged. A wrong-number statement, deceased-customer report, disconnected-line response, or credible mismatch must stop the affected personalized outreach pending resolution. Do not disclose vehicle, finance, service, or other private details to verify an uncertain recipient.

For approved automated outbound campaigns, DEOS requires a documented reassigned-number control that includes FCC Reassigned Numbers Database (“RND”) screening before initial campaign eligibility and refresh at least monthly while outreach remains active, with additional checks when risk indicators arise. Any approved alternative handling of an unavailable or indeterminate result must be documented; no blind fallback is permitted.

An RND query uses the number and a valid consent or reliable last-contact date. “Yes” indicates a permanent disconnection on or after that reference date and requires holding outreach until current ownership and appropriate permission are re-established. “No” does not prove consent or present identity. “No Data” is not clearance and requires review. Retain the query reference date, result, time, and resulting decision.

RND use is not a universal statutory mandate. DEOS adopts it as a risk-control requirement for the campaigns described above. Any RND safe harbor is conditional and limited; it is not immunity from missing consent, do-not-call, timing, content, or other violations. Engineering must verify an operational screening path before enabling a feature that depends on it.

11. AI Voice, IVR, And Required Call Behavior

11.1 Identity And AI Disclosure

DEOS treats AI-generated voices as artificial voices for communication compliance. Customer must not assume that real-time synthesis, a conversational response, a human-sounding voice, or use of an employee replica avoids the applicable artificial/prerecorded-voice rules.

Every outbound DEOS AI call must identify the responsible dealership or seller and disclose its AI nature at the beginning of the interaction. DEOS requires the identity and AI disclosure within the first ten seconds after a live person answers, and before substantive engagement. This is a platform standard, not an assertion that a universal federal ten-second AI-disclosure rule exists. It does not authorize waiting ten seconds where an earlier identification, message-start, or opt-out requirement applies.

The workflow must provide the required business telephone contact and any marketing-purpose disclosure. Calls must not simulate a particular employee without valid likeness authorization, falsely claim a live person is speaking, or conceal the seller through a generic assistant name.

11.2 Interactive Opt-Out And Voicemail

Applicable artificial/prerecorded-voice marketing calls require an automated interactive opt-out with brief instructions. Where FCC rules require the mechanism within two seconds of the caller identification, that timing must be met. The opt-out must remain available during the message and, when used, add the number to the applicable do-not-call list and terminate the call. A model's ability to understand ordinary conversation is not a substitute for a tested opt-out mechanism.

Where required for voicemail, provide a toll-free callback number connecting directly to an automated opt-out mechanism. If that mechanism is not configured and tested, the affected marketing voicemail must not be left. Customer must not substitute an ordinary sales extension.

Applicable message-start, ringing, abandonment, and TSR prerecorded-message requirements must be assessed and tested for the actual call mode. The agent must not create extended dead air, misrepresent a disconnected call, or treat a nominal transfer as a completed human handoff.

11.3 Recording And Human Assistance

Recording, transcription, monitoring, and replica creation have separate permission requirements. Give the required notice and obtain any required consent before the relevant processing. Permission to receive a call is not automatically permission to record it or clone a voice.

Provide an accurate route to human assistance and define business hours, queue ownership, and fallback handling. A human-assistance request must not be ignored to continue an automated sales script. An opt-out request must not be converted into a mandatory handoff.

12. Required AI Opening Templates

The following are baseline templates. The actual named seller, approved purpose, functioning opt-out mechanism, and callback details must be configured before use. Company-approved adjustments may address language, legal requirements, or the actual workflow; they must not remove required disclosures or defeat timing controls. These templates do not supply consent or guarantee compliance in every circumstance.

12.1 Existing Appointment Or Transaction

Hello, this is [AI Name], an AI assistant for [Dealership Legal Or Registered Trade Name]. To stop these calls, say “stop” or press 2. I’m calling about an existing service appointment. Is now a good time?

This is an example. A truthful existing-transaction purpose is always used and never replaced with an unapproved maintenance solicitation or disclosing recipient-specific details before appropriate verification. The keypress stated in the script must work.

12.2 Promotional Communication

Hello, this is [AI Name], an AI assistant for [Dealership Legal Or Registered Trade Name]. To stop these calls, say “stop” or press 2. This is a promotional call about [Approved Offer Or Campaign Purpose]. Is now a good time?

This is an example. It is used only with the required documented marketing permission and other eligibility checks. A request to continue the conversation after answering does not cure missing pre-call permission.

12.3 Approved Marketing Voicemail

This is an AI assistant for [Dealership Legal Or Registered Trade Name], calling about [Approved Promotional Purpose]. To stop these automated marketing calls, call [Tested Toll-Free Opt-Out Number] at any time and follow the automated instructions. You can reach the dealership at [Business Callback Number].

This is an example. It is used only after verification that the actual voicemail configuration meets the applicable requirements. Avoid personal vehicle, service, and finance details in the message.

Where recording or transcription requires a separate notice or consent step, integrate that step before the relevant processing without postponing required identity and opt-out information.

13. Website Chat And Digital Consent Forms

13.1 Keep Chat And Marketing Permission Separate

The widget must clearly identify itself as an AI assistant for the named dealership. A person must be able to begin a supported website chat or make an ordinary inquiry without being forced to consent to future automated marketing calls or texts. Telephone outreach requires its own permission; chat entry does not automatically establish PEWC.

Marketing consent controls must be optional, unchecked, prominent, readable, accessible, and associated with the actual seller and displayed telephone number. Separate text and AI-call choices are the DEOS standard so a consumer can choose either, both, or neither. If consent is declined, do not suppress ordinary chat functionality merely to obtain assent.

Any necessary terms acknowledgment or privacy notice must be presented separately and clearly. A privacy notice explains processing; it is not, by itself, consent to telemarketing. Provide working links to the applicable dealership Privacy Policy and customer-facing Messaging Terms before submission.

13.2 Optional Marketing Text Consent

Current example (note: consent disclosures may be updated):

☐ Optional Marketing Text Consent. By checking this box and selecting Submit, I electronically sign and agree that [Dealership Legal Name d/b/a Trade Name] may send me recurring marketing SMS/MMS messages about vehicles, service offers, promotions, and dealership events at [Displayed Telephone Number], using automated technology, including an automatic telephone dialing system. Consent is not a condition of purchasing any vehicle, goods, or services. Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for help. See the Privacy Policy and Messaging Terms linked below.

13.3 Optional AI/Artificial-Voice Marketing Call Consent

Current example (note: consent disclosures may be updated):

☐ Optional Marketing Call Consent. By checking this box and selecting Submit, I electronically sign and agree that [Dealership Legal Name d/b/a Trade Name] may call me for marketing about vehicles, service offers, promotions, and dealership events at [Displayed Telephone Number], using automated technology, including an automatic telephone dialing system and artificial, prerecorded, or AI-generated voices. Consent is not a condition of purchasing any vehicle, goods, or services. I may revoke permission at any time by telling the caller to stop or by contacting [Dealer Revocation Telephone Or Website]. See the Privacy Policy and Messaging Terms linked below.

The dealer and number must be populated from the actual form, and the visible submit control must match the stated action. All bracketed fields are deployment variables, not text to leave unresolved. The dealership's revocation route must function. These disclosures authorize communications from the named seller, including providers acting solely on its behalf; they do not authorize independent marketing by DEOS or unspecified partners.

13.4 Requested Informational Text

For a person requesting a specific nonmarketing text, use a separate, purpose-limited request control or equivalent documented affirmative instruction (note: current example may be updated):

☐ Send the [Appointment Details / Vehicle Link / Other Specifically Requested Information] I requested by text from [Dealership Name] to [Displayed Telephone Number]. This request does not enroll me in marketing. Message and data rates may apply. Reply STOP to opt out or HELP for help.

Do not select a marketing box automatically because the person requests information. Apply the number-verification process where required for the enabled assistant-SMS program.

13.5 Form Integrity And Evidence

The consumer must perform the affirmative action. Forms must not infer consent from scrolling, inactivity, a prefilled phone field, a browser autofill event, or a salesperson's instruction. Preserve the actual disclosure version and submitted choices, including unselected channels and later changes. Corrected numbers require validation that the consent covers the corrected number.

Company and Customer must test desktop and mobile layouts, accessibility, link availability, checkbox defaults, submission behavior, and evidence capture before launch and after material changes. A template's wording does not cure a defective implementation. A materially nonconforming consent flow must be held or disabled until corrected.

14. Records, Retention, And Compliance Reviews

Maintain evidence of campaign classification and approval, seller identity, recipient authority, consent, registry screening, RND checks where required, content and script versions, sender configuration, executed contacts, opt-outs, and resulting suppression. The applicable record must distinguish a proposed message from a transmitted communication and an attempted call from a completed interaction.

Where TSR recordkeeping applies, its five-year requirements and record-specific starting points control. For example, certain scripts and prerecorded-message records are retained for five years after they cease to be used. Maintain other evidence for the applicable lawful schedule and legal holds. Do not impose indefinite retention of unnecessary message content or extend the separate biometric/replica destruction schedule.

The Order or implementation record must allocate recordkeeping tasks and access/export arrangements. Where the law leaves duties with both seller and telemarketer absent an agreement, an assumption that the other party keeps the records is insufficient. Customer must preserve source evidence it controls and obtain necessary rights to retrieve records from its vendors.

During a credible compliance inquiry, Company may request supporting evidence. Customer must provide it within 48 hours after written request, or sooner where a lawful deadline or urgent risk requires, unless Company agrees in writing to a reasonable alternative. If records cannot be produced within that period, Company may keep affected outreach paused pending verification. This operational deadline does not alter legal privileges, regulator deadlines, or a consumer's rights.

Company may review relevant records through a secure process, with appropriate limits on access, disclosure, and unrelated data. Customer must cooperate in investigating complaints, preserving evidence, correcting errors, and responding to lawful demands. Neither party may delete evidence to obstruct a pending or reasonably anticipated dispute or investigation.

15. Prohibited Conduct And Agent Restrictions

Customer and its users must not:

• Send communications without required permission or conceal marketing inside an informational classification.
• Override suppression, fabricate consent, alter evidence, falsify business identity, or bypass registration, time, frequency, number-status, or access controls.
• Use another number, channel, dealership, agent, vendor, or account to evade a consumer restriction or carrier block.
• Use deceptive caller ID, unauthorized replicas, fabricated reviews, misleading offers, false urgency, or unsupported pricing and availability claims.
• Enable ringless voicemail, predictive dialing, bulk transfer, or another specialized mode without Company approval and its applicable compliance configuration.
• Allow an AI agent to expand consent, change its own compliance rules, access another dealer's records, or treat a generated answer as proof of eligibility.
• Paste protected dealer information into an unapproved external AI service to prepare, evaluate, or troubleshoot a campaign.

AI opt-out recognition and other models must be evaluated and changed under the AI Governance Policy. Statements that AI is “continuously trained” do not authorize private conversations or permission records to enter a shared training pipeline.

16. Monitoring, Suspension, And Remediation

Company may monitor relevant traffic and compliance evidence and may reject, throttle, or pause affected Communications where reasonably necessary to address suspected unlawful activity, missing permission, registration problems, security risk, material misuse, or a provider or legal requirement.

Risk indicators include complaints, unusually high opt-outs or delivery failures, suspected wrong-number traffic, misleading content, unreliable consent sources, carrier alerts, and inability to produce relevant evidence. There is no universal “1%” legal or industry threshold that establishes compliance or noncompliance. Applicable carrier thresholds and Company-approved risk limits must be assessed in context. Traffic below a threshold may still be unlawful.

Company may act immediately where delay creates material risk. Where feasible, it will explain the basis, limit the affected scope, and provide an opportunity to correct the issue, subject to legal and security restrictions. Reinstatement requires verified remediation and any required provider approval; a new campaign name is not remediation.

Suspension, termination, cure periods, charges, refunds, and other remedies remain governed by the Agreement, including Subscription Terms Section 21. This Policy does not create an unrestricted termination-for-convenience right for paid commitments or authorize indefinite billing solely because Company elects to hold traffic.

17. Indemnification, Responsibility, And Remedies

Customer's communications-related defense and indemnity obligations are those stated in Subscription Terms Section 20 and any controlling negotiated addendum. They apply to covered third-party claims arising from Customer-directed communications, unlawful campaigns, missing permissions, Customer-supplied content, or other specified Customer breaches, subject to the required causal connection and claim procedures.

Recoverable amounts include those the Agreement lawfully covers, including fines and penalties only to the extent indemnification is legally permitted. An allegation alone does not prove Customer caused a loss. No obligation is imposed to the extent a claim is caused by Company's breach, negligence, unlawful conduct, unauthorized processing, or material departure from lawful instructions, as provided in the Subscription Terms.

This Policy does not transfer every possible liability to Customer, bind a regulator or consumer to the parties' allocation, or waive a nonwaivable duty. It creates no separate unlimited indemnity, new liability cap, automatic penalty, or additional defense-control procedure. The Agreement's notice, defense, cooperation, settlement, liability, and dispute provisions apply.

18. Privacy, AI Governance, And Related DEOS Documents

Communication permissions, recipient data, recordings, prompts, and compliance records are protected information. Processing must follow the Privacy Policy, applicable data-processing terms, and AI Governance Policy, including dealer isolation, limited access, approved processing paths, and restrictions on shared training and independent provider use.

Mobile information and messaging opt-in/consent data must not be sold or shared with third parties or affiliates for independent marketing or promotional purposes. Minimum necessary operational disclosures to the directing dealership and contracted delivery, verification, screening, or compliance providers remain subject to the applicable restrictions. Carrier delivery and an approved RND lookup do not authorize DDU export to an outside shared AI system.

This Policy aligns with the following documents, which must be made available through the Company's legal and policy pages and the applicable acceptance process:

The White Paper and Hybrid Autonomous Dealer Model describe operating concepts. Signal counts and lifecycle touchpoints do not authorize contacting every customer at every touchpoint or override consent, time, frequency, suppression, or commercial-authority limits.

19. Administration, Legal Changes, And Contacts

Company must maintain an applicable jurisdiction and channel requirements register, designated owners, training, launch tests, and periodic review. A change in law, carrier rules, campaign purpose, seller identity, source, consent flow, or agent behavior requires assessment and any necessary revalidation before affected use continues.

November 2026 regulatory transition. FCC 26-67, published October 26, 2026, states an effective date of November 25, 2026. It modifies category treatment for informational revocations and permits certain clearly disclosed exclusive revocation methods. It is not treated here as already effective on November 4. DEOS's acceptance of reasonable requests and broader expressed opt-outs remains its operating standard; that change does not automatically narrow the Policy or restore withdrawn consent. The January 6, 2026 waiver is also linked for context. Legal must confirm the operative rules and any later orders when implementing the transition.

Material Policy amendments must follow the Agreement's notice and acceptance requirements. A new publication cannot retroactively create permission for past calls or texts. Legally required restrictions apply according to law even if a website update has not yet been completed.

Operational support, opt-out assistance, and urgent campaign concerns: support@deos1.com
Legal inquiries, compliance evidence requests, and formal notices: legal@deos1.com

Consumers may also contact the dealership identified in the communication. No login, purchase, special legal wording, or explanation is required to make a clear opt-out request. Do not send passwords, full financial records, unrestricted customer exports, or sensitive biometric materials by ordinary email; Company will arrange an appropriate method when needed.

I REVLAB, INC.
4910 Communications Ave, Suite 120
Boca Raton, FL 33431

Authorities And Compliance Resources

These links support the legal and operational discussion. Statutes, rules, judicial decisions, orders, and provider requirements have different authority and scopes. References are not government approval, a compliance certification, or a substitute for assessment of a particular campaign. Regulatory status was reviewed for this draft as of November 4, 2026.

Federal Statute, FCC Rules, And AI Voice

1. 47 U.S.C. § 227 — Telephone Consumer Protection Act, official U.S. Code.
2. 47 CFR § 64.1200 — FCC delivery restrictions. Includes consent, identification, opt-out, and do-not-call provisions; check effective amendments and applicable waivers.
3. FCC 24-17 — Declaratory ruling on AI-generated voices. AI-generated voices fall within the artificial/prerecorded-voice framework; this does not establish the DEOS ten-second standard as a universal federal mandate.
4. FCC 26-67 — Final rule published October 26, 2026, effective November 25, 2026. Review the actual effective text and any later developments for revocation handling.
5. DA 26-12 — January 6, 2026 revocation waiver order. Historical transition context; do not apply it without considering subsequent rules and orders.
6. Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277 — Official Eleventh Circuit opinion, January 24, 2025. Vacates the challenged 2023 one-to-one and logically/topically associated consent restrictions. DEOS retains its separately stated seller-specific sourcing standard.

Telemarketing, Records, And Do-Not-Call

7. 16 CFR Part 310 — FTC Telemarketing Sales Rule, including § 310.4, abusive practices and prerecorded-call provisions, and § 310.5, recordkeeping.
8. FTC — Complying With The Telemarketing Sales Rule. Guidance on seller and telemarketer duties, registry access, prerecorded messages, and exceptions.
9. FTC — Telemarketing Sales Rule recordkeeping changes. Explains the five-year framework and allocation of recordkeeping responsibilities.
10. National Do Not Call Registry — Telemarketer access.

Reassigned Numbers And Messaging Providers

11. FCC-designated Reassigned Numbers Database — Official administrator FAQs, and query-result guidance. Explains reference dates, “Yes,” “No,” “No Data,” and the conditional safe harbor.

12. Twilio — A2P 10DLC requirements. Provider guidance distinguishes long-code registration from toll-free and short-code arrangements; the actual selected provider's current requirements control its service.

13. CTIA — Messaging Principles And Best Practices. Voluntary industry guidance; apply the selected provider’s actual contractual requirements.

Illustrative State Authorities And Related Channels

14. Florida Statutes § 501.059 — Telephone solicitation, and § 501.616 — Unlawful telemarketing acts and practices. Coverage, exemptions, hours, and frequency must be assessed for the actual activity.
15. Maryland General Assembly — Official laws and statutes portal, Commercial Law Title 14, Subtitle 45; Oklahoma Legislature — Official statutes portal, Title 15, Oklahoma Telephone Solicitation Act. These are illustrative, not an exhaustive state-law register.
16. FTC — CAN-SPAM Act compliance guidance. Email permissions and required message elements are separate from phone/text consent.