Which rules apply to which calls.
Compliance for inbound voice and SMS depends on where the caller is, where you are, and what industry you operate in. This page is a navigator — it tells you which regime applies to your situation and points to the rule-of-record document that governs it.
Three things determine which rules apply.
Compliance for inbound voice and SMS is layered. Whose data is it (the caller's)? Where are they (which state or province)? Where is the business that received the call (you)? The combination determines which rules apply. The four tabs below each frame one piece of that picture; together, they form your obligation set.
- Caller location → privacy law (PIPEDA, CCPA, state laws, GDPR)
- Caller location → SMS rules (CASL for Canadians, TCPA for Americans)
- Your business location → recording-disclosure law (most jurisdictions overlap, but two-party-consent states differ)
- Industry → vertical rules (HIPAA for healthcare, FINTRAC for some real-estate, etc. — most explicitly out of scope today)
Personal Information Protection and Electronic Documents Act.
PIPEDA applies to private-sector organizations that collect, use, or disclose personal information in the course of commercial activity in Canada. It governs how we and you handle caller data — names, phone numbers, transcripts, recordings. Compliance is structural in MeetIndi: tenant isolation, data residency in Canada, and self-serve access and deletion are designed into the platform.
- Applies whenever the caller is in Canada — this is the default for the pilot
- Right of access (PIPEDA Schedule 1, Principle 9 — Individual Access; operationalized by Section 8 of the Act) — callers can request a copy of their personal information; we surface a self-serve export inside Settings → Privacy
- Right to deletion — honored on request, with the legal-retention exceptions noted on /privacy
- Data residency — Cloud SQL Postgres in northamerica-northeast2 (Montreal); your data does not leave Canada
- Reference: /privacy is the rule of record; this page is a navigator
Canada's Anti-Spam Law applies to outbound SMS, full stop.
CASL is enforced structurally in MeetIndi. Every outbound SMS requires an immutable sms_consent_log entry referencing how consent was captured. There is no admin override, no "just this once" toggle, no override for a specific lead. If consent does not exist for a given recipient, the code path refuses to send. That is the same regardless of where you are or where the recipient is.
- In-call verbal consent is the most common capture path; logged with call SID + timestamp
- Inbound SMS from the lead creates implied consent for a reply window
- Opt-out keywords (STOP, UNSUBSCRIBE, CANCEL) processed automatically and logged
- Consent log is append-only; revoked consents are flagged but never deleted
- Reference: /casl for the structural guarantees, /a2p-toll-free for the carrier registration that wraps this
California, Colorado, Virginia, Connecticut — and the rest as they land.
For US callers, the relevant frameworks are CCPA (California), VCDPA (Virginia), CPA (Colorado), CTDPA (Connecticut), and the growing patchwork of state privacy laws. They differ in details but share a common spine: notice at collection, right to know, right to delete, right to opt-out of sale or sharing. Our practices honor the strictest reading: we do not sell or share customer data, recordings or transcripts.
- Right to know — surfaced via the same self-serve export in Settings → Privacy
- Right to delete — same surface; same legal-retention exceptions documented on /privacy
- Right to opt-out of sale or sharing — moot, because we do not do either
- Notice at collection — provided at call start via the recording disclosure (heard before any conversational content)
- TCPA applies separately to outbound SMS for US recipients; we honor the same consent-log gate as CASL
In progress, not the primary market at launch.
GDPR is the strictest of the major regimes. We are reviewing our data-handling practices against it, but EU customers are not a primary market at v1 and we handle them case-by-case via DPA. If your callers are based in the EU, write to us before signing up so we can confirm scope.
- Status: in active review, not formally compliant at launch
- EU-based callers are handled case-by-case with a DPA; not a self-serve flow today
- Data residency in the EU is not currently offered; the platform runs in northamerica-northeast2 (Canada)
- Right to erasure, portability, and rectification are conceptually parallel to PIPEDA + CCPA but with stricter timelines
- Reference: write to us first if your traffic profile includes EU residents
One-party vs two-party consent — what we do, what you should know.
Call-recording laws vary by state and province. Some places require only one party to know the call is being recorded; others require all parties to consent. MeetIndi handles this with a per-tenant, jurisdiction-aware setting: an opt-in pre-call disclosure that fires deterministically before any conversational content, used by tenants who operate under two-party-consent regimes. Canadian tenants who rely on one-party consent (operator-as-consenting-party) keep the disclosure off by default and the call goes straight to Indi. You still own the call of which posture applies to your business; this section is what we do, not legal advice.
- Two-party-consent states (US): California, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania, Washington — and a few others. Tenants serving callers in these states enable the pre-call disclosure during onboarding; it fires before Indi connects, on every call.
- One-party-consent states (US): the majority. Tenants here may run with disclosure off (operator is the consenting party) or opt in for caller transparency.
- Canada: Criminal Code §184(1) prohibits intercepting private communications; §184(2)(a) permits recording with the consent of one party (§183.1 defines consent). Default for Canadian tenants is disclosure off — the operator is the consenting party. Tenants under provincial regulators with stricter notice requirements can opt in.
- When enabled, disclosure plays via a deterministic Polly.Joanna <Say> on the inbound TwiML before <Connect><Stream>; not LLM-generated, not skippable in-flow, and Indi is told a disclosure has already played so she does not double-disclose.
- When disabled, no opening <Say> fires — Indi greets the caller directly. The recording itself is still made; the legal basis is the operator's one-party consent, not the caller's.
- Reference: /casl + /security cover the structural enforcement; /privacy documents what is retained.
What we do not handle, and why we say so.
Some regulated domains are explicitly out of scope at v1. Saying so up front is more honest than handling them quietly without a defensible posture. If your business operates in one of these domains, MeetIndi is not the right fit today and we would rather tell you that before you sign up than after.
- HIPAA / PHI — we do not handle Protected Health Information and we do not sign BAAs. Healthcare-specific call handling is not in scope.
- PCI-DSS scope — we do not handle credit-card numbers in voice or SMS; if your business needs to take payment over the phone, we are not the right fit
- Children — COPPA / Quebec Law 25 child-data rules — we do not knowingly collect data from people under 13, and we are not designed for that use case
- Financial advice or KYC for regulated financial institutions — we do not provide regulated advice; FINTRAC-mandated KYC is the customer's responsibility
- Legal advice — we do not provide it; a legal-vertical Indi captures intake, not advice
Caller location → regime mapping.
The most common situations, with the rule-of-record document for each. If your situation is not represented here, write to us and we will tell you honestly whether we are the right fit.
| Caller location | Privacy regime | SMS rules | Rule of record |
|---|---|---|---|
| Canada (excluding QC) | PIPEDA | CASL | /privacy + /casl |
| Quebec | Law 25 | CASL + FR disclosure | Waitlist (write to us) |
| United States — California | CCPA / CPRA | TCPA | /privacy |
| United States — other states | Patchwork (VCDPA, CPA, CTDPA, &c.) | TCPA | /privacy |
| European Union | GDPR | ePrivacy + member-state rules | Case-by-case DPA |
| United Kingdom | UK GDPR | PECR | Case-by-case DPA |
| Healthcare (any jurisdiction) | Out of scope | Out of scope | No HIPAA BAA |
This is a navigator, not legal advice. Your counsel is the right party to confirm what applies to your specific situation; this page tells you what we have built into the platform and which documents memorialize the commitments.
Need a specific compliance answer?
We are happy to talk specifics with your counsel before signup. If your situation is on a regime we have not yet mapped, tell us up front — we would rather scope the conversation than discover a mismatch after pilot.
Rule-of-record documents: Privacy, CASL, DPA, Sub-processors, Terms.