Version 2026-09-26-draft1

CallQA Acceptable Use Policy

DRAFT, not legal advice, to be reviewed by counsel. Version: 2026-09-26-draft1. Not in force. [COUNSEL: ...] notes and [À COMPLÉTER] fields must be resolved before publication.

Last updated: [À COMPLÉTER: publication date]

This Acceptable Use Policy (the "AUP") is part of the Terms of Service. Capitalized terms have the meaning given in the Terms. It applies to every user, API key, schedule and CI job of your organization.

CallQA places real automated phone calls with synthetic voices. It exists to test telephone systems that you control. Anything else is prohibited.

1. Prohibited uses

You must not use the Service, or help anyone use it, to:

1.1 Call people or organizations that did not agree

• place calls to any number that your organization does not own and is not authorized in writing to have called by an automated system (see Terms section 4);
• place calls to residential lines or personal mobile phones, unless the subscriber is your own employee or contractor who agreed in writing, for the purpose of testing your service;
• use lists of numbers, number ranges, sequential or random dialing, or numbers scraped or bought from third parties.

1.2 Robocalls, marketing and surveys

• make telemarketing, sales, promotional, political, fundraising or survey calls;
• deliver any message whose purpose is to reach the person who answers, rather than to test the system that answers;
• make calls that would require prior express consent under the TCPA (47 U.S.C. § 227) or equivalent laws, without holding that consent.

1.3 Harassment, threats and unlawful content

• harass, threaten, intimidate, stalk or abuse anyone, including the staff of a call center;
• place repeated calls to overload a line, a call center or an IVR (telephony denial of service), beyond the load testing that the owner of the line has authorized in writing;
• use scenarios, personas or voices that are hateful, sexually explicit, defamatory or that incite violence or illegal acts.

1.4 Fraud, impersonation and social engineering

• obtain money, credentials, personal data or any advantage by deception;
• test social engineering or fraud techniques against a line whose owner has not authorized that specific test in writing (for example a bank's call center, even if the scenario is labeled as a "security test");
• impersonate a real person, a public authority, a bank or any organization, or imitate the voice of a real person without their written consent;
• generate artificially inflated traffic to earn telephony revenue (International Revenue Share Fraud, traffic pumping).

1.5 Spoofing and caller identity

• try to change, hide or falsify the caller ID of calls placed by the Service. Calls always present a CallQA number. [COUNSEL: the Truth in Caller ID Act, 47 U.S.C. § 227(e), prohibits spoofing with intent to defraud, cause harm or wrongfully obtain anything of value; confirm whether other rules should be cited, e.g. STIR/SHAKEN obligations of our carrier.]

1.6 Emergency, premium rate and special numbers

• call, or try to call, emergency numbers (for example 911, 112, 999, 15, 17, 18) or any number that reaches emergency services, including through a transfer from an IVR;
• call premium rate, shared cost, audiotext, personal numbering, or any number whose call generates revenue for the called party;
• design scenarios that ask an IVR or an agent to transfer the call to such a number.

The Service blocks these numbers before dialing. The block may not be perfect; you remain responsible for not targeting them.

1.7 Real sensitive data

Scenarios, personas and test data must use fictitious or test values only. Never inject: - real payment card numbers, bank account numbers or card security codes (use the test numbers published by payment providers); - real passwords, one-time codes, API keys or other credentials; - real health data, including protected health information within the meaning of the US HIPAA rules, and data concerning health within the meaning of GDPR art. 9; - real government identifiers (Social Security numbers, passport, national ID, tax numbers); - data about children, or any other special category of personal data (GDPR art. 9 and 10).

CallQA is not designed or certified to process such data (no PCI DSS scope, no HIPAA business associate agreement). [COUNSEL: confirm that stating "no BAA" is enough, given the healthcare booking use case shown on the landing page.]

If the system you test reads back real sensitive data about real people during a call (for example a production IVR that announces a real account balance), you must use test accounts, or not test that path with CallQA.

1.8 Bypassing limits and controls

• work around ownership verification, the sandbox, the Number Attestation, country restrictions, blocked destinations, rate limits, concurrency limits, spend caps or quotas, for example by creating several organizations or accounts, sharing verification codes, rotating API keys, or splitting a number into variants;
• probe, scan or test the security of the Service without our written authorization (responsible disclosure: see section 4);
• resell the Service or give access to third parties outside your organization, except to your own clients whose lines you test under their written authorization.

1.9 Illegal use in general

• use the Service in breach of any applicable law, including telecommunications, telemarketing, call recording, data protection, consumer protection, export control and sanctions laws.

2. Monitoring

To protect the people who might be called and the networks we use, we monitor use of the Service, including by automated means. Signals include, for example: - an automatic review of every scenario before it can place a call, and again each time its content changes: a scenario that appears to breach section 1 is held for a human review by CallQA staff or refused, with the reasons shown to you (see Compliance review of scenarios); you may ask for a human review through CallQA support; - a high proportion of calls not answered, or hung up in the first seconds; - words in the transcript of the called party that suggest a wrong or unwanted call (for example "stop calling", "wrong number", "who is this"); - many distinct numbers called by a recently created organization; - repeated failed ownership verifications; - complaints from called parties, carriers or authorities.

Monitoring uses the Trace of calls. It is described in the Privacy Policy. [PRODUCT: these signals are specified in docs/research/number-verification.md §4 but are not implemented yet, see README.]

3. Enforcement

Depending on the severity, we may, without prior notice and without liability: 1. block a single call or scenario; 2. suspend a Target Number (status suspended), a schedule or an API key; 3. suspend the organization; 4. terminate the organization under the Terms (section 15.3), without refund where the Terms allow it; 5. keep the evidence (attestations, verification records, Traces, audit log) and report the facts to the relevant carrier, regulator or law enforcement authority where required or permitted by law.

We will tell the organization's admins what happened and how to appeal, unless the law or an authority prevents it. Appeals: [À COMPLÉTER: abuse or support email], within 30 days.

4. Reporting abuse and security issues

If you received a call from CallQA that you did not expect, or believe the Service is being misused, write to [À COMPLÉTER: [email protected]] with: - the number that was called; - the date, time and time zone of the call; - the caller ID displayed, if known; - any detail that helps us find the call.

We acknowledge reports within [À COMPLÉTER: 2 business days] and suspend calls to the reported number while we investigate. You do not need a CallQA account to report abuse. [PRODUCT: publish a public page (for example callqa.dev/calls) explaining who calls from our numbers and linking to this form; reference it in the caller ID name (CNAM) where possible.]

Security vulnerabilities: [À COMPLÉTER: [email protected]]. Please do not access data that is not yours and give us reasonable time to fix before disclosure.

5. Changes

We may update this AUP. The Terms (section 17) explain how changes are notified.

Version history