# Schedule D — Acceptable Use Policy

**VoxTelAI, LLC**, a Delaware limited liability company · EIN 36-5176377 · 1111b South Governors Avenue, Suite 55006, Dover, DE 19904, United States · +1 (302) 342-6155 · legal@rolycall.com

Document **VTA-SD-2026.08** · published at `rolycall.ai/aup`

## D1. Scope

**D1.1** This Acceptable Use Policy is Schedule D to the Agreement; capitalised terms: General Terms section 1.

**D1.2** This Schedule binds the Customer and governs all use of the Services and the Customer's credentials — by its users, the clients it serves through the Platform and anyone else, authorised or not. The Customer is responsible for all use of its account and answers for its users and clients as for itself.

**D1.3** The rules below are not exhaustive: unlawful use, or use breaching a carrier or numbering-authority requirement VoxTelAI has notified, is prohibited even if not listed. Where this Schedule and Applicable Law differ, the stricter applies; nothing here waives a duty Applicable Law imposes directly on the Customer.

**D1.4** Where a Module applies, it prevails over this Schedule on its subject (General Terms section 21; Module US (US3, US4, US7, US8); Module EU/UK (EU2, EU3)). The General Terms prevail on emergency services, liability, data protection and compliance (General Terms section 2).

**D1.5** VoxTelAI may amend this Schedule only as General Terms 19.3 provides (30 days' notice; termination without charge if materially adverse).

## D2. General prohibitions

**D2.1** The Customer must not use the Services, and must not permit their use:

(a) in breach of Applicable Law, including the law of the country of origin, of each Destination and of any country in which a Number is issued;

(b) to infringe an intellectual property, publicity or privacy right;

(c) to transmit or generate content that is defamatory, obscene, harassing or threatening, or that promotes violence, terrorism or the sexual exploitation of children;

(d) to distribute malicious code or send denial-of-service, SIP or registration flooding or other traffic likely to impair a network or system;

(e) to misrepresent the identity of the calling or sending party, or the origin, routing or nature of traffic;

(f) to evade a block, filter, label, suspension, limit or termination applied by VoxTelAI, a carrier or a regulator, including by opening further accounts or rotating identifiers (D3.4);

(g) for fraudulent or artificial traffic, including schemes inducing return calls to premium or revenue-share numbers, traffic pumping, international revenue-share fraud, toll fraud, unauthorised use of a credential, trunk or endpoint, SIM boxes, grey routes or unauthorised refile; or

(h) for unlawful surveillance, covert monitoring, stalking or unlawful interception.

**D2.2** The Customer must not use a Number where the person recorded in the applicable registration profile (Schedule A (A2.4)) does not meet the numbering authority's conditions, must keep that profile current, and must return a Number when eligibility ends. Numbers are allocated for use, not sold.

**D2.3** No Service carries calls to an Emergency Number (General Terms section 8). The Customer must not configure any Service, AI system or campaign to place, transfer or bridge such a call, must not imply that one is reachable or that VoxTelAI performs an emergency-calling duty for it, and must pass the section 8 warning to the persons to whom it gives access.

## D3. Caller identity

**D3.1** The Customer may present as CLI:

(a) any Number;

(b) any other number it is entitled to present — one assigned to it, one whose holder has given current written authority, or one that Applicable Law or a written order of a court or competent authority requires or expressly permits; or

(c) no number, where presentation is withheld or anonymised and the Destination permits that.

**D3.2** On VoxTelAI's written request the Customer must evidence its entitlement under D3.1(b) within 2 Business Days. For a Number it has allocated, VoxTelAI gives the allocation warranty and confirmation in General Terms 11.3; that confirms allocation only, not lawfulness of presentation at a Destination (D4).

**D3.3** The Customer must not present any CLI with intent to mislead, defraud or cause harm, and must not supply false information to obtain a call-authentication attestation or defeat or alter call authentication applied by VoxTelAI or an upstream carrier.

**D3.4** The Customer must not rotate or substitute numbers, trunks, sender identifiers, accounts or other identifiers so as to evade a block, filter, label, suspension or limit, dilute volume or disguise the calling party. Rotation as a product feature is available only for Numbers, through a Local Presence Pool ordered as a Service Order in the Portal (Schedule A (A2.6)).

## D4. Automated, AI and outbound calling

**D4.1** This D4 applies to every outbound call placed through the Services — by a live operator, a dialler, the AI Agent or the Customer's own AI system connected under Schedule A (A4.5).

**D4.2** For each call, the Customer must hold the consent or other lawful basis that the Applicable Law of the origin and of each Destination requires for that call, its content and the method of dialling. A business-to-business exemption, legitimate interest or other basis may be relied on only where the law of that Destination provides it.

**D4.3** This Schedule does not prohibit calling contacts from lists the Customer has purchased, rented or obtained from a third party, and does not make their use lawful: D4.2 must be met for each contact and the source recorded under D4.4(g); where Module EU/UK applies, its EU3 requires the prior consent or other basis the ePrivacy Rules of that Destination impose for automated or AI marketing calls. VoxTelAI does not vet, approve or warrant any list, contact, script or lawful basis; activation, routing or silence is not approval, and the lawfulness of every contact and call remains the Customer's responsibility (General Terms section 13).

**D4.4** The Customer must:

(a) maintain a suppression list of everyone who objects or opts out by any reasonable means and, before dialling, scrub every campaign against it and every official or operator do-not-call register that applies at the Destination;

(b) honour an objection or opt-out as soon as practicable and within the period Applicable Law requires, and not re-contact a suppressed number without a new, documented lawful basis;

(c) observe any calling-time restriction that applies at the Destination;

(d) identify the calling party (and, where Applicable Law requires, the party on whose behalf it calls and a contact number) at the start of each automated or AI call and on every marketing call;

(e) where Applicable Law requires, disclose at the start of the interaction that the called party is speaking with an AI system — by the disclosure prompt (Schedule A (A5.4)) or its own means — and not shorten, conceal or obscure that disclosure;

(f) give the called party a route to a human on request, and transfer the call to a human where Applicable Law requires;

(g) keep, for at least 24 months after the later of its capture and the last call relying on it, or longer where Applicable Law, a Module or D8.4 requires, a record of the lawful basis for each contact (for a legitimate interest or business-to-business exemption, per list or campaign), with number, source, campaign and, for consent, date, method and disclosure text, and of each opt-out and when it was applied;

(h) offer, where Applicable Law requires, a means to opt out during an automated or AI call, and apply an opt-out received on any channel to every channel used to contact that person;

(i) observe any abandoned-call and call-frequency limit at the Destination, play the message Applicable Law requires on an abandoned call and place no silent call; and

(j) configure the Schedule A (A4) compliance tools where it relies on them, and keep its Portal abuse contact reachable at any time of day.

**D4.5** The Customer must not use an AI feature to impersonate a person, business or public authority, to conduct social engineering (including eliciting one-time passcodes or payment-card data), to infer emotion or sensitive characteristics or process biometric data without the lawful basis Applicable Law requires, or to clone the voice of an identifiable natural person without that person's documented, specific, informed and current consent, revocable at any time, and never of a minor or, without the estate's authority, a deceased person.

**D4.6** VoxTelAI publishes in the Portal the quality thresholds it applies to outbound traffic (for example complaint rates, traceback requests, short-duration and answer-seizure ratios) and may change them on 7 days' notice in the Portal and by email. Thresholds apply to each Number and, in aggregate, to a Local Presence Pool and a campaign. Where a threshold is exceeded, or complaints, a traceback or a carrier or regulator notice indicate abuse, VoxTelAI may pace, limit, block or suspend the affected campaign, Number or trunk under D9, telling the Customer which indicator was exceeded and what must change.

## D5. Recording and transcription

**D5.1** The Customer must not record, monitor, transcribe or analyse a call or message unless it holds the consent or other lawful basis, and has given the notice, that every jurisdiction connected with the communication requires — the origin, each Destination and each participant's location; where they differ, the strictest applies.

**D5.2** The recording announcement and periodic tone are features governed by Schedule A (A7.2), which also states when the Platform enables the announcement by default and when VoxTelAI may require it; the settings selected and the duty under D5.1 to notify and obtain consent remain the Customer's.

**D5.3** Recordings, transcripts and AI Output derived from them are Customer Data, retained for the period the Customer configures in the Portal (Schedule A (A7)).

## D6. Messaging

**D6.1** The Customer must not send an application-to-person message to a recipient who has not given the prior consent Applicable Law and the receiving carrier require, and must not message numbers taken from purchased, rented or scraped lists — stricter than D4.3 because receiving carriers impose it.

**D6.2** The Customer must register each sender identifier, brand or campaign where the Destination or receiving carrier requires it, must keep the content, opt-in method and use case of every message consistent with that registration, and must not use a sender identifier without authorisation.

**D6.3** The Customer must not send phishing or smishing, messages impersonating a brand, public authority or individual, links that conceal their destination, or content in a category the receiving carrier prohibits for the route used unless VoxTelAI confirms in writing it is permitted.

**D6.4** The Customer must not spread similar traffic across numbers, sender identifiers, campaigns or accounts to dilute volume, evade filtering or disguise the sender.

**D6.5** The Customer must support standard opt-out and help keywords in the language of the message, must not require any further step to opt out, and must honour every opt-out immediately.

## D7. Security and credentials

**D7.1** The Customer must not scan, probe, stress-test or penetration-test the Platform, Portal, API or a VoxTelAI network without VoxTelAI's prior written authorisation, requested from `abuse@rolycall.com` and stating scope, method and window.

**D7.2** The Customer must keep credentials, SIP passwords and API keys confidential; use unique, strong credentials per trunk, endpoint and Portal user; enable multi-factor authentication on every Portal account with administrative or financial rights; rotate API keys when a person with access leaves or changes role; keep its PBX and endpoints patched; restrict access by IP address where supported; and enable the fraud controls and spend limits the Portal offers.

**D7.3** The Customer must notify `abuse@rolycall.com` immediately, and in any event within 24 hours, of a suspected compromise of a credential, trunk or endpoint (General Terms 5.3).

**D7.4** The Customer must not circumvent a rate, concurrent-call or calls-per-second limit, spend cap, geographic restriction, destination block or fraud control applied by VoxTelAI, and must not reverse-engineer, copy or interfere with the Platform.

**D7.5** The Customer must keep its registration and contact information accurate and, where Applicable Law requires, must screen the clients it serves through the Platform against the sanctions lists General Terms section 10 refers to and any further list a Module names, suspending a positive match and telling `legal@rolycall.com` within 1 Business Day.

## D8. Complaints, traceback and lawful requests

**D8.1** The Customer must cooperate with VoxTelAI, carriers, traceback consortia, regulators and law-enforcement authorities in any investigation of traffic on its account, and suspend a user or client whose traffic breaches this Schedule.

**D8.2** The Customer must respond within the periods below, measured from VoxTelAI's request unless a row states otherwise. A missed period permits VoxTelAI to act under D9; a repeated or unremedied failure to respond is a material breach (General Terms section 10).

| Request | Customer response due |
|---|---|
| Traceback request from a traceback consortium, a carrier or a regulator | 24 hours, identifying the user, client or campaign from which the traffic originated and the relevant call detail records |
| Notice of suspected fraud, illegal traffic or imminent harm to a person, network or service | 4 hours, at any time of day |
| Evidence of entitlement to present a number as CLI (D3.2) | 2 Business Days |
| Record of lawful basis, objection or opt-out for a contact or campaign (D4.4) | 2 Business Days; 24 hours where the request cites a regulator, a carrier or a traceback |
| Demand from a regulator, court or law-enforcement authority relayed by VoxTelAI | the period the demand states, or 2 Business Days if it states none |
| Lawful process the Customer receives directly concerning traffic, a Number or an End User | forward to `legal@rolycall.com` within 1 Business Day, unless the process prohibits it |
| Abuse or complaint notice that is not urgent | acknowledgement within 1 Business Day; remediation and written report within 3 Business Days |

**D8.3** The Customer authorises VoxTelAI to disclose its identity, account, registration and call detail records and traffic patterns to carriers, traceback consortia, regulators and law-enforcement authorities so far as necessary to answer a traceback, complaint, demand or investigation and Applicable Law permits, disclosing only what is reasonably required, seeking confidential treatment where available and notifying the Customer beforehand where lawfully permitted.

**D8.4** From notice of a traceback, complaint, investigation or D8.2 demand until the matter is closed, each Party must preserve the relevant logs, call detail records, lawful-basis and registration records and configurations and must not delete that material or allow its automatic deletion; general retention is in General Terms 10.7.

**D8.5** Anyone may report suspected abuse to `abuse@rolycall.com` (numbers, time and time zone, description, campaign or sender identifier); urgent reports of imminent harm may also be made by telephone to +1 (302) 342-6155. VoxTelAI acknowledges a report within 1 Business Day (4 hours where it alleges imminent harm or fraud), acts under D9 where substantiated, and withholds a reporter's identity unless Applicable Law or an investigation requires it. VoxTelAI answers a traceback or enquiry from a traceback consortium, carrier or regulator within the period that body specifies or, if none, 24 hours, and where traffic is identified as unlawful or a D4.6 threshold exceeded takes a measure under D9 within 1 Business Day (immediately under D9.3).

## D9. Enforcement

**D9.1** VoxTelAI has no obligation to monitor traffic but may inspect signalling, traffic patterns, registration data and, where Applicable Law permits, content, to investigate breaches, fraud and threats to network integrity.

**D9.2** Where VoxTelAI reasonably and in good faith determines that this Schedule has been or is likely to be breached, it may take one or more of these measures, proportionate to the breach and, except under D9.3, after notice and a reasonable opportunity to cure:

| Step | Measure | Typical trigger |
|---|---|---|
| 1 | Written warning with a required remediation plan | first or low-severity breach |
| 2 | Pacing or limiting of calls per second, concurrent calls, message throughput or spend | continuing breach; a threshold under D4.6 exceeded |
| 3 | Blocking of a Destination, number range, campaign, sender identifier, trunk, AI configuration or IP address | breach localised to identifiable traffic |
| 4 | Suspension of some or all Services | material or repeated breach, failure to remediate, missed period under D8.2 |
| 5 | Termination of the affected Service Order or of the Agreement, on the terms in General Terms section 4 | severe or repeated breach, fraud, regulator or carrier demand |

**D9.3** VoxTelAI may act immediately and without prior notice where there is: (a) a risk of imminent harm to a person, network or service; (b) a demand or direction from a regulator, court, law-enforcement authority or underlying carrier; (c) suspected fraudulent or illegal traffic; (d) a compromise of the Customer's credentials; or (e) a legal obligation to block the traffic. It notifies the Customer within 24 hours, or as soon as it lawfully may (General Terms 4.5), and says what must change for the measure to be lifted.

**D9.4** A measure is limited to the traffic, Number, trunk, campaign or Service concerned so far as VoxTelAI can reasonably isolate it. Suspension does not relieve the Customer of Charges incurred or of any minimum commitment the Order Form states; no Service Credit accrues while a Service is limited, blocked or suspended under this Schedule.

**D9.5** VoxTelAI lifts a measure promptly once the cause is removed and may condition reinstatement on a written remediation plan, evidence of compliance, an adjusted spend cap or any reinstatement charge stated in the Rate Card. Fines, carrier charges and de-listing costs VoxTelAI incurs through a breach are recoverable under General Terms 5.6 and section 13, within section 12 save as 12.4 provides.

**D9.6** No measure under this D9 removes an emergency-calling capability, because no Service carries such calls; it may prevent ordinary calls, so the Customer and its users must keep a separate means of reaching emergency services (General Terms section 8).

---