Cart Billing App

Cart Billing App/SMS Terms and Conditions

!Draft — not yet in force

This document is a first-pass draft prepared for review by a licensed attorney. It is not legal advice and should not be relied on. Values shown as highlighted code are placeholders that must be resolved before publication, including the contracting entity, registered address, governing law, and retention periods.

36 values still to set

All of these live in src/lib/legal/config.ts and are read from the environment. Nothing needs editing in the document text.

  • legalEntityName — legal entity name
  • entityType — entity type
  • stateOfIncorporation — state of incorporation
  • registeredAddress — registered address
  • privacyContactEmail — privacy contact email
  • billingContactEmail — billing contact email
  • governingLawState — governing law state
  • arbitrationForum — arbitration forum
  • arbitrationVenue — arbitration venue
  • liabilityLookbackMonths — liability lookback (months)
  • liabilityFloorAmount — liability floor
  • securityDisclosureUrl — disclosure policy URL
  • securityResponseTimeframe — security response timeframe
  • securityOverviewUrl — security overview URL
  • securityIncidentNoticeHours — incident notice window (hours)
  • dpaBreachNoticeHours — DPA breach notice window (hours)
  • slaSummary — SLA summary
  • sccModule — SCC module
  • accountRetentionMonths — account retention (months)
  • authLogRetentionMonths — auth log retention (months)
  • serverLogRetentionDays — server log retention (days)
  • paymentRecordRetentionYears — payment record retention (years)
  • smsConsentRetentionYears — SMS consent retention (years)
  • marketingSuppressionRetentionMonths — email suppression retention (months)
  • terminationExportDays — post-termination export window (days)
  • backupRotationDays — backup rotation (days)
  • smsDailyMessageCap — SMS daily message cap
  • abuseReviewFee — abuse review fee
  • dataCenterRegion — data center region
  • awsSesRegion — AWS region
  • smtpProviderName — SMTP provider name
  • smtpProviderRegion — SMTP provider region
  • stripeRegions — Stripe regions
  • twilioRegions — Twilio regions
  • errorTrackingProvider — error tracking provider
  • errorTrackingRegion — error tracking region

Subprocessor locations still to confirm: Stripe, Twilio, Amazon Web Services (SES), Self-hosted VPS operator, Umami Analytics.

Cart Billing App updates these documents by posting a new version with a new effective date. The version above is what applies to your account.

SMS Terms and Conditions

Version 2026-09-28 · Effective 2026-09-28

These SMS Terms and Conditions (the “SMS Terms”) govern text messages that legalEntityName sends to your business customers on your behalf, or that you send through the Cart Billing App platform. They are incorporated into the Terms of Service and the Acceptable Use Policy.

By the time you enable SMS for a customer, that customer’s consent must already exist, be documented, and be consistent with the law where the customer’s number is registered. Enrolling a number in our system is not consent. Carriers screen these programs independently, and our enrollment does not guarantee delivery.

2. Message frequency and content

Message frequency must be reasonable in light of what the customer agreed to expect. A customer who consents to billing notifications should not receive marketing. Our platform applies a per-recipient frequency cap of smsDailyMessageCap as a backstop; exceeding it causes the send to fail, which is intentional.

Message content must be truthful, accurate, and not misleading, must not contain content that is unlawful or that the recipient is entitled to a free and unsolicited alternative to, and must clearly identify the sender and a way to reach you. Programmatic sender registration and any required brand or campaign filing is your responsibility. We may require you to register a sender or campaign before we will send on a given destination number, and we may reject or withhold any message that we believe is unlawful, deceptive, or likely to be filtered.

Automated collections. Automated late-fee notices and overdue reminders are collection messages. Send them only where your Fee Policies permit, disclose the amounts and any fees, and give the customer a meaningful opportunity to pay or to dispute before further collection messages are sent. Do not use text messages to collect a debt from a customer you know is in a dispute, hardship, or legal proceeding.

3. Message and data rates

Message and data rates may apply to each SMS message you send and receive. Charges are imposed by your wireless carrier and may vary by plan and by destination. You are responsible for all charges imposed on your customers’ numbers, and you must not represent the Service as being free to receive.

4. Opting out and HELP

Every message we send on your behalf includes:

Reply STOP to opt out. Message and data rates may apply.

We send this on every message, and you may not remove it. STOP, UNSUBSCRIBE, END, QUIT, CANCEL, OPT OUT, and REPLYSTOP to that number will opt the customer out of all messages. HELP, STOP, or INFO returns an automated help message. We process opt-outs automatically and continuously, and you cannot override an opt-out.

After a customer opts out, send them no further messages except a single confirmation that the opt-out was applied. There is no charge for that confirmation. We do not sell or share opted-in numbers.

5. Privacy

Mobile numbers and consent records are personal information. Our handling of them is described in the Privacy Policy. You are the controller of your customers’ mobile numbers; legalEntityName acts as your processor under the DPA and as an agent for the transmission of the message. Messages are transmitted through Twilio, which acts as our telecommunications subprocessor and as a participant in industry programs that filter traffic. We do not use message content for advertising. We retain opt-out and consent records for smsConsentRetentionYears so that we can demonstrate compliance.

6. Our rights and contact

legalEntityName may suspend, throttle, or block a sender, a destination number, or the messaging functionality as a whole, with or without notice, if we reasonably believe that messages are being sent without valid consent, that a recipient has complained, that a campaign is misconfigured, or that continued sending would put us or you at risk of violating law or a carrier rule. We may also require a sender registration, a sample message review, or proof of consent before resuming.

Complaints about a text message — including a claim of no consent, of a STOP not honored, or of a charge you dispute — go to admin@example.com and to the business named as the sender in the message, at registeredAddress. Include the sending number, the approximate time, and the message content. We investigate substantiated complaints and will stop messaging a number where consent cannot be evidenced.

These SMS Terms are governed by the law stated in section 20 of the Terms of Service.