Acceptable Use Policy

This policy forms part of the Terms of Service. It applies to everyone using Vaarto and to every message sent through it.

It exists for a practical reason as much as a legal one: on WhatsApp, the recipients decide your fate. Blocks and “report” taps drive down the quality rating Meta assigns your number, and a number with a low rating gets its messaging limit cut, then restricted, then disabled. We cannot appeal that for you. Most of this policy is how to avoid it.

1. Consent

Message only people who have opted in to hear from you on WhatsApp, on that number, for the kind of message you are sending. The opt-in must be clear, must name your business, and must say that messages come by WhatsApp. Keep a record of it.

A phone number collected for delivery, billing or account verification is not consent to market to it.

2. Opt-outs

Honour every opt-out, promptly and permanently, however it arrives.

A recipient who replies STOP is opted out. We surface this to you — the inbound webhook carries optChange: "opted-out" when the text was STOP, and "opted-in" on START — but acting on it is yours to do. Continuing to message someone who has opted out is a breach of this policy and of Meta’s.

A recipient who simply asks you to stop in their own words has also opted out.

3. What you must not send

Do not use Vaarto to send, request or facilitate:

• Unsolicited bulk messaging. No purchased, scraped or rented lists. No messaging a number because it was in a dataset.
• Anything unlawful under Indian law or the law where the recipient is.
• Fraud or deception. Phishing, impersonating another business or person, fake offers, advance-fee schemes, or misrepresenting who the sender is.
• Content Meta prohibits, including the categories in the WhatsApp Commerce Policy: alcohol, tobacco and e-cigarettes, drugs, weapons and ammunition, live animals, adult products and services, gambling and real-money gaming where not licensed, medical and healthcare products where restricted, body parts and fluids, and supplements making prohibited claims.
• Hate speech, harassment, threats or content inciting violence.
• Sexual content, and anything involving the exploitation of children.
• Malware, or links to it.
• Misinformation likely to cause harm, and political or election messaging where it is restricted.
• Multi-level marketing, pyramid schemes and get-rich-quick offers.
• Unlicensed financial, credit, insurance or investment solicitation.

4. How you must use the platform

Do not:

• share, resell or sublicense access, or operate a messaging service for third parties on your account without our written agreement;
• probe, scan or test the platform’s security, or try to bypass authentication, scopes or rate limits;
• use a credential you were not issued, or keep using one you know has leaked;
• send automated traffic designed to degrade the service for others;
• misrepresent a template’s purpose to get it approved, or use an approved template to send something materially different;
• send to a number you have no record of consent for, to test or otherwise.

5. Content that is yours to stand behind

You are responsible for what your templates say and what your agents write. Where a message makes a claim about price, delivery, refunds or a product’s effect, it must be accurate and you must be able to substantiate it.

Your business must be identifiable from your display name and your messages.

6. Security of your own endpoints

If you receive webhooks, verify the HMAC-SHA256 signature on every request before acting on the body. An endpoint that processes unverified payloads is an open door, and we treat a compromise reached that way as yours to have prevented.

Keep API keys out of client-side code, public repositories and support tickets.

7. What happens if you breach this policy

Depending on what has happened, we may:

• contact you and ask you to fix it;
• throttle, suspend or disable a number or an API key;
• suspend the workspace;
• terminate the account under the Terms of Service; and
• report the matter where the law requires it.

We will tell you what we have done and why, and we will give notice first where it is practical and safe to do so. Where Meta restricts a number directly, we will pass on what Meta tells us — but the decision and any appeal are Meta’s.

8. Reporting abuse

If you have received a message sent through Vaarto that breaks this policy, tell us at the abuse address at the foot of this page. Include the sending number, the time, and the message if you still have it. We investigate every report.