Use these templates on your website, then add the public URL to your EchoTexting campaign as the Privacy Policy Link. Carriers and The Campaign Registry (TCR) expect a policy on your domain that clearly covers text messaging.
This is a starting template, not legal advice. EchoTexting does not provide legal services. Have qualified counsel review your policy before you publish it—especially if you sell or share personal information, run loyalty or financial-incentive programs, collect health or financial data, market to children, or operate outside the United States.
Publish terms of use as well. Use the SMS Terms of Use Template if you need one. Also read the SMS Compliance Guide for consent, STOP/HELP, and recordkeeping requirements.
How to use
- Choose a template
- Already have a privacy policy? Use Template A (SMS addendum). Paste it as a new section and keep the rest of your policy.
- No privacy policy yet? Use Template B (full policy) as a new page.
- Replace every placeholder in
[BRACKETS]with your business details. Do not leave brackets on the published page. - Host it on your own public website (for example
https://yourbusiness.com/privacy). Do not put it behind a login. TCR and carriers often reject missing, generic, or platform-hosted policies. - Paste the live URL into your campaign Privacy Policy Link field when you create or edit the campaign.
- Link the same URL from every SMS opt-in (website form, keyword landing page, paper form). EchoTexting’s website SMS signup form uses the campaign privacy policy URL in the consent language. Also publish and link terms of use (see the SMS Terms of Use Template).
Do not copy EchoTexting’s own privacy policy onto your site. That document covers our platform, not your texting program.
Placeholders
Replace these values in both templates:
| Placeholder | What to put |
|---|---|
[COMPANY NAME] | Legal business name as customers know you |
[WEBSITE URL] | Your public website (include https) |
[PRIVACY EMAIL] | Inbox you monitor for privacy requests |
[PRIVACY PHONE] | Phone number for privacy or HELP requests |
[POSTAL ADDRESS] | Business mailing address |
[MESSAGE TYPES] | What you send, e.g. appointment reminders, order updates, promotions |
[MESSAGE FREQUENCY] | How often you text, e.g. up to 4 messages per month, or message frequency varies |
[SMS NUMBER] | The number people text or receive messages from |
[EFFECTIVE DATE] | Date you publish or last update the policy |
If a line does not apply (for example you do not use website cookies), delete that sentence rather than leaving placeholder text.
Carrier / TCR checklist
Reviewers commonly look for all of the following on the public page:
| Requirement | Why it matters |
|---|---|
| Policy is public and mentions SMS / text messaging | Generic website policies with no SMS language are often rejected |
| Lists SMS data collected (phone number, opt-in method and timestamp, message content) | Shows you know what the program collects |
| States you do not sell or share mobile numbers or SMS opt-in data with third parties or affiliates for their marketing | Required by CTIA messaging principles and a frequent TCR fail |
| Explains STOP, HELP, message frequency, and “Msg & data rates may apply” | Matches the disclosures used at opt-in |
| Names service providers used to deliver messages | You may list EchoTexting as your SMS platform / service provider |
| Provides a contact method for privacy requests | Needed for TCPA recordkeeping and California consumer requests |
Template A — SMS addendum
Use this if you already have a privacy policy. Add it as its own section (for example “Text Messaging”) and update your table of contents if you have one.
TEXT MESSAGING / SMS PROGRAM Effective date: [EFFECTIVE DATE] [COMPANY NAME] (“we,” “us,” or “our”) operates a text messaging program. This section explains how we collect, use, and share information in connection with SMS/MMS messages. It supplements our Privacy Policy at [WEBSITE URL]. If there is a conflict between this section and another part of our Privacy Policy about mobile numbers or SMS opt-in data, this section controls. Program description You may opt in to receive recurring SMS and/or MMS messages from [COMPANY NAME] at [SMS NUMBER]. Messages may include [MESSAGE TYPES]. Message frequency: [MESSAGE FREQUENCY]. Message and data rates may apply. For help, reply HELP or contact us at [PRIVACY EMAIL] or [PRIVACY PHONE]. You can opt out at any time by replying STOP. After you opt out we will send a one-time confirmation and then no further messages unless you opt in again. Information we collect for SMS When you opt in, we collect: - Mobile phone number - Opt-in method, date, and time (for example web form, keyword, verbal, or paper form) - Consent language you agreed to - Message content you send or receive - Delivery and opt-out records How we use this information We use SMS information to: - Send the messages you requested - Confirm opt-in and honor opt-out (STOP) and help (HELP) requests - Provide customer support - Maintain required consent and compliance records - Detect abuse, fraud, or violations of law Sharing of mobile information We do not sell, rent, or share your mobile phone number, SMS opt-in data, or consent records with third parties or affiliates for their own marketing or promotional purposes. All categories of information described in this policy exclude text messaging originator opt-in data and consent; that information will not be shared with any third parties except as needed to provide the messaging service you requested (for example our SMS platform and mobile carriers) or as required by law. Service providers We use service providers to operate the texting program, including EchoTexting as our SMS platform, mobile carriers, and hosting providers. These parties may process your information only to provide services to us and are not permitted to use your SMS opt-in data for their own marketing. Consent records and retention We keep opt-in, opt-out, and related records for as long as you remain subscribed and afterward as needed for legal, tax, and compliance purposes (including Telephone Consumer Protection Act recordkeeping). We then delete or de-identify the information when we no longer need it. California notice at collection (SMS) If you are a California resident, the following is our notice at collection for information gathered for the texting program: - Categories: identifiers (such as name and mobile phone number); customer records; commercial information related to your relationship with us; and internet or electronic activity if you opt in on our website. - Sources: you (and, if applicable, our website forms or in-person sign-up). - Purposes: providing the SMS program, customer service, security, and legal compliance, as described above. - Sale or sharing: we do not sell your personal information, and we do not share it for cross-context behavioral advertising. We do not sell or share mobile phone numbers or SMS opt-in data. - Retention: for the life of your subscription plus the period needed for legal and compliance records, then deletion or de-identification. - Your rights: California residents may request to know, access, correct, or delete personal information, and to opt out of sale or sharing. We will not discriminate against you for exercising these rights. To submit a request, email [PRIVACY EMAIL], call [PRIVACY PHONE], or write to [POSTAL ADDRESS]. You may use an authorized agent as allowed by law. We will verify your request before completing it. Contact Privacy questions and requests: [PRIVACY EMAIL] | [PRIVACY PHONE] | [POSTAL ADDRESS] Website: [WEBSITE URL]
Template B — Full standalone privacy policy
Use this if you do not already have a privacy policy. Publish it as a public page on your site, then link that URL from opt-in forms and from your EchoTexting campaign.
PRIVACY POLICY Effective date: [EFFECTIVE DATE] [COMPANY NAME] (“Company,” “we,” “us,” or “our”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information when you visit [WEBSITE URL], communicate with us, or join our SMS/MMS text messaging program. If you do not agree with this policy, please do not use our website or opt in to texts. For questions, contact [PRIVACY EMAIL]. 1. Who we are [COMPANY NAME] [POSTAL ADDRESS] [PRIVACY EMAIL] | [PRIVACY PHONE] Website: [WEBSITE URL] 2. Information we collect Information you provide - Identifiers such as name, email address, mailing address, and phone number - Business or account details you choose to give us - Content of communications, including text messages, emails, and form submissions - Payment or transaction details if you purchase from us (processed by our payment provider) SMS / text messaging information - Mobile phone number - Opt-in method, date, and time - The consent language you agreed to - Message content and delivery/opt-out records Information collected automatically When you visit our website, we may collect IP address, browser and device type, referring URL, pages viewed, and similar usage data through cookies or similar technologies. You can control cookies through your browser settings. We do not collect personal information from children under 13, and our texting program is not directed to children. 3. How we use information We use personal information to: - Operate our website and business - Send SMS/MMS messages you requested, including [MESSAGE TYPES] - Respond to inquiries and provide customer support - Process orders or appointments - Maintain security and prevent fraud or abuse - Comply with law, including TCPA consent recordkeeping - Improve our services 4. How we share information We do not sell your personal information. We do not share personal information for cross-context behavioral advertising. We may disclose information to: - Service providers that help us operate, such as our SMS platform (EchoTexting), website hosting, payment processors, and analytics providers. They may use the information only to provide services to us. - Mobile carriers, to deliver text messages - Professional advisors (legal, accounting) under confidentiality - Authorities when required by law, or to protect rights, safety, or security - A successor in a merger, acquisition, or sale of assets, subject to this policy Mobile numbers and SMS opt-in data. We do not sell, rent, or share your mobile phone number, SMS opt-in data, or consent records with third parties or affiliates for their own marketing or promotional purposes. All categories of information in this policy exclude text messaging originator opt-in data and consent; that information will not be shared with any third parties except to provide the messaging service you requested or as required by law. 5. Text messaging program You may opt in to receive recurring SMS and/or MMS messages from [COMPANY NAME] at [SMS NUMBER]. Messages may include [MESSAGE TYPES]. Message frequency: [MESSAGE FREQUENCY]. Message and data rates may apply. - Opt out: reply STOP at any time. We will send a one-time confirmation and then stop messaging you unless you opt in again. - Help: reply HELP or contact [PRIVACY EMAIL] or [PRIVACY PHONE]. - Consent is not a condition of purchase. - Carriers are not liable for delayed or undelivered messages. We keep SMS consent and opt-out records for as long as you are subscribed and afterward as needed for legal and compliance purposes, then delete or de-identify them. 6. Cookies and analytics We may use cookies or similar tools to operate the site, remember preferences, and understand usage. If you do not use cookies, delete this section. If you use advertising cookies that share data with ad networks, update the “sale/share” statements in this policy before publishing—do not claim you do not share data if your analytics or ads do. 7. Retention We keep personal information only as long as needed for the purposes described here, including to provide services, resolve disputes, enforce agreements, and meet legal, tax, and TCPA recordkeeping obligations. Typical SMS consent records are retained for at least four years after the last interaction, then deleted or de-identified where feasible. 8. Security We use reasonable administrative, technical, and physical safeguards designed to protect personal information. No method of transmission or storage is completely secure. 9. Children’s privacy Our website and texting program are intended for individuals 13 years of age or older (or the age of majority in your jurisdiction if higher). We do not knowingly collect personal information from children under 13. If you believe we have, contact [PRIVACY EMAIL] and we will delete it. 10. California privacy rights (CCPA/CPRA) If you are a California resident, this section applies in addition to the rest of this policy and serves as our notice at collection. Categories collected (depending on how you interact with us) - Identifiers (name, email, phone number, IP address, account identifiers) - Customer records (contact and transaction information) - Commercial information (products or services considered or purchased) - Internet or other electronic activity (site usage, SMS opt-in on the web) - Approximate geolocation derived from IP address, if collected by our site - Inferences, if we create them from the above (optional; delete if you do not) We do not collect sensitive personal information for the purpose of inferring characteristics. If that changes, we will update this policy. Sources - Directly from you - Your devices and our website - Service providers that process data for us Business purposes - Providing services and the SMS program - Customer service and communications - Security, debugging, and fraud prevention - Legal compliance - Short-term, transient use - Quality and safety of our services Sale and sharing We do not sell personal information as defined by California law. We do not share personal information for cross-context behavioral advertising. We do not sell or share mobile phone numbers or SMS opt-in data. If this changes, we will provide a “Do Not Sell or Share My Personal Information” link and honor opt-out requests, including via the Global Privacy Control where required. Retention We retain each category only as long as needed for the purposes above, then delete or de-identify it. SMS consent records are typically kept for the subscription plus a compliance period of at least four years. Your rights California residents may request to: - Know / access the categories and specific pieces of personal information we collected, sources, purposes, and categories of recipients - Delete personal information, subject to legal exceptions - Correct inaccurate personal information - Opt out of sale or sharing (if we ever sell or share) - Limit use and disclosure of sensitive personal information (if applicable) - Not be discriminated against for exercising these rights How to submit a request Email [PRIVACY EMAIL], call [PRIVACY PHONE], or write to [POSTAL ADDRESS]. Please say that you are making a California privacy request and describe what you want us to do. We will verify your identity (for example by matching information you provide to our records) before completing the request. You may use an authorized agent as allowed by law; we may require proof of authorization and may still need to verify you. We will respond within the time required by law. If we need more time or cannot complete a request, we will explain why. Shine the Light (Cal. Civ. Code 1798.83) California residents may request information about our disclosure of personal information to third parties for their direct marketing. We do not disclose personal information to third parties for their own direct marketing. To make a Shine the Light request, contact [PRIVACY EMAIL] with the subject line “California Shine the Light Request.” 11. Additional U.S. state privacy rights Depending on where you live (for example Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and similar state laws), you may have the right to: - Access or obtain a copy of personal data - Delete personal data - Correct inaccuracies - Opt out of the sale of personal data, targeted advertising, and/or certain profiling We do not sell personal data or use it for targeted advertising as those terms are commonly defined in these laws. To exercise a state privacy right, contact [PRIVACY EMAIL] or [PRIVACY PHONE]. We will not discriminate against you for exercising your rights. Some states allow you to appeal a denied request; if we deny your request, we will explain how to appeal. 12. Your choices - SMS: reply STOP to opt out; reply HELP for help - Email: use the unsubscribe link where provided, or email [PRIVACY EMAIL] - Cookies: adjust your browser settings - Privacy requests: use the contact methods above 13. Changes to this policy We may update this Privacy Policy from time to time. The effective date at the top will change when we do. The updated policy will be posted at [WEBSITE URL]. Continued use of our website or texting program after the update means you acknowledge the revised policy. 14. Contact us [COMPANY NAME] [POSTAL ADDRESS] [PRIVACY EMAIL] [PRIVACY PHONE] [WEBSITE URL]
After you publish
- Open the page in a private/incognito window and confirm it loads without signing in.
- Search the page for leftover
[BRACKETS]. - Confirm the page says you do not share mobile numbers or SMS opt-in data with third parties for their marketing.
- Add the URL to your EchoTexting campaign Privacy Policy Link.
- Add a Terms & Conditions Link as well (use the SMS Terms of Use Template if needed).
- Link both URLs on every opt-in (web form, keyword page, paper form, verbal script follow-up).
- Update the page if your message types, frequency, providers, or data practices change.
If you are unsure whether the template matches how you actually use data, pause and get legal review before you submit the campaign to TCR.