SMS Consent Policy

1. Purpose

This SMS Consent & Marketing Text Policy explains how Invent LLC ("Company") obtains consent for, and sends, text messages related to the Saha app, and sets the compliance baseline for the federal Telephone Consumer Protection Act (TCPA), FCC/CTIA guidance, and state-level "mini-TCPA" laws (Florida, Oklahoma, Texas, Maryland, Washington, and others) that in several cases impose stricter rules than federal law.

2. Two Categories of Messages -- Different Consent Rules

Transactional / Account Messages Messages necessary to deliver the Service you've already requested: verification codes (OTP), security alerts, safety- report confirmations, and critical account notices. These are sent based on your providing a phone number during account setup and do not require separate marketing consent, but recipients must still be able to text HELP for support. Marketing / Promotional Messages Messages promoting the Service, features, offers, or re-engagement (e.g., "You have 3 new matches -- open the app" campaigns framed as promotional, subscription discount offers, win-back campaigns). Under the TCPA, these require prior express written consent when sent via an automated system -- a legal standard higher than a general Terms-of-Service acceptance.

3. Obtaining Prior Express Written Consent for Marketing Texts

• Consent must be captured through a clear, standalone opt-in -- a distinct checkbox or toggle for SMS marketing, not pre-checked, and not bundled into general Terms of Service acceptance or account creation.
• The opt-in screen must disclose: that consent is not a condition of using the Service or making a purchase; the phone number that will be used; the identity of the sender (Saha / Invent LLC); message content/purpose; approximate frequency ("up to X msgs/month"); that message and data rates may apply; and how to opt out (reply STOP).
• Consent is captured and logged with a timestamp, the exact consent language shown, IP address, and method (e.g., in-app toggle) -- this record is your primary defense in a TCPA dispute and must be retrievable per phone number.
• Consent obtained for one purpose (e.g., account/security texts) does not extend to marketing texts -- a separate opt-in is required for each category.

4. Required Message Content

• First marketing message in a campaign identifies the sender ("Saha") and confirms opt-in status.
• Every marketing message supports reply STOP to opt out and reply HELP for support, honored automatically at the carrier/platform level.
• Opt-out requests are processed immediately (no "reasonable time" delay) and confirmed with a final one- time opt-out confirmation text, after which no further messages are sent absent new consent.

5. Time-of-Day and Frequency Restrictions

• No marketing texts before 8:00 a.m. or after 9:00 p.m. in the recipient's local time zone (CTIA best practice and the general federal standard) -- determined by the area code/registered number, not Company's time zone.
• Connecticut, Louisiana, Maryland, restrict calls made before 9:00 am or after 8:00 pm. Michigan is considering a similar law.
• Florida, Nevada, Oklahoma, Oregon, Washington, and Wyoming restrict calls made before 8:00 am or after 8:00 pm. South Carolina and West Virginia are considering similar laws.
• Pennsylvania restricts calls made before 9:00 am or after 7:00 pm.
• Louisiana, Mississippi, and Pennsylvania prohibit calls on Sundays and some holidays.
• Maryland, Nevada, Oklahoma, and Oregon restrict the number of calls within a 24-hour period to three calls on the same topic. West Virginia is considering a similar limitation.
• Message frequency for marketing campaigns is capped and disclosed at opt-in (e.g., "up to 4 msgs/month"); actual sending must not exceed the disclosed frequency.

6. State-Specific Considerations

Florida (FTSA) Florida's mini-TCPA authorizes a private right of action with statutory damages of $500 per violation ($1,500 if willful), based on the recipient's Florida area code regardless of where Company is located. 2023 amendments narrowed some autodialer-related claims, but time-of-day and consent violations remain actively litigated -- Florida is currently the single largest source of mini-TCPA class filings nationally. Oklahoma, Texas, Maryland, Washington, and other emerging state laws Private Enforcement Rights: Georgia, Oklahoma, Oregon, Texas, and Washington all include private rights of enforcement of their respective telecommunications laws, each of which is subject to substantial statutory penalties. Michigan, South Carolina, and West Virginia are all considering laws that may include private enforcement rights. Restrictions on Caller ID Spoofing: Illinois, Nevada, New Jersey, Pennsylvania, Tennessee and Washington all include explicit prohibitions on caller ID spoofing. West Virginia is considering a similar requirement. Some states require disclosures of identity and purpose to be made within specific time frames. Connecticut requires disclosures in the first 10 seconds. Masschusetts requires disclosures within the first minute. New Jersey and Washington require disclosures within the first 30 seconds. Illinois, New York, and Virginia only require that the disclosures be made early on in the call. Georgia and Virginia allow claims based on vicarious liability for third parties in certain contexts. Extra care should be exercised to ensure that vendors servicing these states are in compliance with all state and federal requirements.

7. Do Not Call / Do Not Text Registries

Company will scrub marketing-text recipient lists against the National Do Not Call Registry status where applicable and honor any recipient-specific opt-out permanently, not just for the current campaign. Colorado, Florida, Indiana, Louisiana, Massachusetts, Mississippi, Missouri, Oklahoma, Pennsylvania, Tennessee, Texas, and Wyoming maintain state-level DNC lists. Company will scrub marketing-text recipient lists against these state-level DNC lists. Michigan requires Company to maintain DNC records for four years.

8. Carrier Registration (10DLC / A2P)

Note that Indiana, Mississippi, and Texas appear to also require registration of telemarketing campaigns with their respective state agencies.

9. Vendor and Platform Responsibilities

If Company uses a third-party SMS platform (e.g., Twilio, Attentive, Klaviyo), the consent-capture, STOP/HELP handling, and quiet-hours logic described above must be technically enforced by that platform's configuration, not merely described in this policy. Legal and Engineering should jointly confirm platform settings match this document before the first campaign send, and re-confirm after any platform migration.

10. Contact

privacy@the-saha.com -- for consent/opt-out disputes. Reply STOP to any Saha text message to opt out immediately.