Customer SMS Compliance Guide

1. Why This Guide Exists

Kyvora is a technology platform. Recruiting organizations and staffing agencies that use Kyvora own the recruiting relationship with their candidates, and Customers own the responsibility for obtaining and documenting candidate SMS consent.

Kyvora does not recruit candidates, does not collect candidate consent on a Customer's behalf, and does not originate outreach. Kyvora facilitates message delivery after a Customer has already obtained legally required consent. This guide documents the consent standard Customers must implement before using Kyvora's SMS functionality.

This guide supplements the Messaging Policy and Acceptable Use Policy. All three apply to your use of Kyvora messaging.

2. Customer Responsibilities

Before sending any SMS message through Kyvora, Customers must:

• Obtain legally required consent from each candidate before messaging
• Retain records of that consent for at least three years
• Clearly identify themselves as the message sender
• Honor STOP requests immediately and across all campaigns
• Provide a HELP response identifying the sender and support contact
• Follow all applicable TCPA, carrier, and messaging requirements
• Not send messages before obtaining consent
• Not re-add opted-out recipients without new, documented consent

3. Required Consent Elements

A compliant candidate SMS consent flow must include each of the following elements. All are required — partial compliance is not sufficient.

• ✔
  Active affirmative consent — Candidate takes a deliberate action to opt in — not a pre-selected state.
• ✔
  Unchecked checkbox — Consent checkbox must default to unchecked. Candidates must check it themselves.
• ✔
  Phone number collection — The consent form must collect the mobile number that will receive messages.
• ✔
  Sender identity — The consent language must name your organization as the sender.
• ✔
  Message purpose — Describe the types of messages the candidate will receive (e.g., screening, scheduling, recruiting updates).
• ✔
  Message frequency varies — Include the phrase "Message frequency varies" or equivalent.
• ✔
  Message & data rates may apply — Include carrier cost disclosure.
• ✔
  STOP to opt out — Include "Reply STOP to opt out" or equivalent.
• ✔
  HELP for help — Include "Reply HELP for help" or equivalent.
• ✔
  Link to Privacy Policy — A clickable link to your Privacy Policy must appear near the consent checkbox.
• ✔
  Link to Terms — A clickable link to your Terms of Service or Terms & Conditions must appear near the consent checkbox.
• ✔
  Consent not a condition of employment — Must include language stating that consent is not required to apply for a job, be considered for employment, or receive a job offer.

4. Sample Consent Language

The following is an example of compliant consent language. You may adapt it for your organization, but all required elements above must remain present.

See the Sample SMS Consent page for a fully rendered example of a compliant candidate application form, including the consent checkbox, disclosure language, and required links.

5. Recordkeeping Requirements

Kyvora recommends retaining the following for each candidate consent record. Upon written request from Kyvora, you must be able to produce this information:

• Date and time consent was given
• Mobile phone number for which consent was given
• The exact consent language shown to the candidate at the time of opt-in
• URL of the page where consent was collected
• The candidate's affirmative action (e.g., “checkbox checked”, “form submitted”)
• IP address of the candidate at time of consent (where available)
• Version of your Privacy Policy in effect at the time
• Version of your Terms in effect at the time
• Full opt-out history for the number

Retain consent records for at least three years, or longer if required by applicable law.

6. Prohibited Practices

Customers may not:

• Use pre-checked consent checkboxes
• Bundle SMS consent with acceptance of service terms or any other required agreement
• Use purchased, rented, scraped, or third-party contact lists
• Send messages before obtaining documented consent
• Continue messaging a candidate after they reply STOP
• Re-add an opted-out candidate without obtaining new, documented consent
• Share candidate phone numbers with third parties for unrelated marketing or outreach
• Misrepresent your organization's identity as the message sender

7. Opt-Out and HELP Handling

8. Platform Enforcement

Customers are expected to maintain compliant candidate consent before and during their use of Kyvora's SMS functionality. Kyvora may suspend a Customer's messaging capabilities if:

• The Customer cannot demonstrate compliant consent upon request
• Kyvora receives credible complaints from candidates or carriers
• The Customer is found to be sending messages without documented consent
• The Customer's STOP or opt-out rate exceeds carrier thresholds

9. SMS Enablement Certification

When enabling SMS messaging for the first time, Kyvora requires each organization to certify that it:

• Obtains legally required recipient consent before messaging
• Maintains proof of consent for each recipient
• Honors STOP requests promptly and across all campaigns
• Does not use purchased, rented, or scraped contact lists
• Agrees to comply with the Messaging Policy and this Customer SMS Compliance Guide

This certification is recorded with a timestamp and is tied to the policy version in effect at the time of certification. Customers must re-certify when material policy updates are issued.

10. Related Policies and Resources

• Messaging Policy
• Acceptable Use Policy
• Sample SMS Consent Form
• SMS & TCPA Disclosure
• Privacy Policy
• Terms of Service