Legal

Compliance

This page describes Callengo's compliance posture across the regulatory frameworks most relevant to AI-powered outbound calling: federal and state telemarketing law, data protection law, data security, and acceptable use. It also covers the compliance measures implemented on the Callengo marketing website (callengo.com), including cookie consent management, ePrivacy Directive compliance, and email marketing practices. Finally, it describes the obligations that our customers must independently satisfy.

Last Updated: March 27, 2026 · Nothing on this page constitutes legal advice.

Compliance at a Glance

A summary of the key frameworks and obligations Callengo addresses. Detailed explanations follow below.

TCPA & Calling Law

AI-generated voice consent framework
Prior express written consent requirements
National & state DNC Registry compliance
Federal calling hours enforcement
All-party recording consent by state

GDPR Compliance

Data Processing Addendum (DPA) available
Standard Contractual Clauses for EU transfers
All 8 GDPR data subject rights honored
Legal basis documented for every processing activity
AEPD as lead supervisory authority

CCPA / CPRA

No sale or sharing of personal information
Service provider contract terms included
California resident rights honored
No combination of Contact data across customers
45-day response to CCPA requests

Data Security

AES-256-GCM encryption for all OAuth tokens
TLS 1.2+ for all data in transit
Row-level security on all 57 database tables
HMAC-SHA256 webhook signature verification
HSTS enforced on all Callengo domains

Data Retention

30-day default call recording retention
12-month Recording Vault add-on available
90-day data export window post-cancellation
7-year financial record retention
Immediate OAuth token deletion on disconnect

Acceptable Use

Prohibited: DNC calls without exemption
Prohibited: PHI processing (no BAA offered)
Prohibited: calls to minors under 18
Prohibited: deceptive AI impersonation
Prohibited: PCI-scoped payment card data

Website Cookie Compliance

Google Consent Mode v2: all storage denied by default
Usercentrics CMP with IAB TCF v2.2 certification
No tracking cookies until explicit user consent
Granular consent categories (Functional, Analytics, Marketing)
Cookie preferences accessible anytime via footer

Website & Email Marketing

ePrivacy Directive compliant cookie banner
HubSpot CRM data processed in EU1 region
CAN-SPAM compliant outbound email campaigns
Explicit opt-in for newsletter subscriptions
Unsubscribe mechanism in all marketing emails

DETAILED SECTIONS

01TCPA: Telephone Consumer Protection Act

02FTC Telemarketing Sales Rule (TSR)

03GDPR Compliance

04CCPA / CPRA Compliance

05Data Security Posture

06Data Retention Policy

07Acceptable Use Policy

08HIPAA & Regulated Industry Notice

09CAN-SPAM Act

10Marketing Website Compliance

11Email Marketing Compliance

12Compliance Contact & Reporting

01TCPA: Telephone Consumer Protection Act

1.1

What the TCPA Requires. The Telephone Consumer Protection Act (47 U.S.C. § 227) is the primary federal law governing automated and AI-powered outbound calls in the United States. The TCPA prohibits: initiating any call using an automatic telephone dialing system (ATDS) or an artificial or prerecorded voice to a wireless telephone number without the prior express written consent of the called party; initiating any call using an artificial or prerecorded voice to a residential telephone line without prior express consent; and initiating telemarketing calls to any number registered on the National Do Not Call Registry, subject to limited exemptions.

FCC February 2024 Ruling: AI Voice Calls

The Federal Communications Commission issued a declaratory ruling in February 2024 clarifying that AI-generated voices (including the voice synthesis technology used by AI calling platforms) constitute "artificial voices" for purposes of the TCPA. This means that calls using AI-generated voices to wireless telephone numbers require prior express written consent of the called party, regardless of whether the calls are classified as telemarketing. This ruling applies directly to the AI Voice Agents deployed through Callengo.

1.2

Callengo's Position Under the TCPA. Callengo is a technology infrastructure provider. We do not initiate calls on our own behalf, select contact lists, define campaign purposes, or operate as a telemarketer. All outbound calls placed through the Callengo platform are initiated by and legally attributable to the Callengo business customer (the account holder) that configured and launched the campaign. Under the TCPA, the party legally responsible for a call is the one that initiates it with a purpose: the entity that controls the contact list, defines the campaign objective, and authorizes the call. Because Callengo's customers supply their own contact lists, configure their own agent scripts, and authorize each campaign, TCPA responsibility resides with the customer as the calling party.

1.3

Customer Obligations: Prior Express Written Consent. Before placing any AI-generated voice call to a wireless telephone number, customers must have obtained the prior express written consent of the called party. "Prior express written consent" under the TCPA requires a signed written agreement (which may be electronic) that: (i) is signed by the person to be called; (ii) clearly and conspicuously discloses that the person agrees to receive calls using an artificial or prerecorded voice from or on behalf of the calling entity; (iii) identifies the entity placing the calls; and (iv) is not a condition of any purchase of goods or services. Customers must maintain records of all consents in a form that can be produced upon demand.

1.4

National Do Not Call Registry. Customers are solely responsible for scrubbing their contact lists against the National Do Not Call Registry (maintained by the FTC at donotcall.gov) before uploading contacts to the Callengo platform. Callengo does not perform DNC registry scrubbing on behalf of customers. Under FTC regulations, telemarketers must re-synchronize their contact lists against the National DNC Registry at least once every 31 days. Customers must also comply with applicable state DNC registries, including those maintained by California, Colorado, Florida, Indiana, Louisiana, Massachusetts, Missouri, New York, Oregon, Pennsylvania, Texas, Wyoming, and other states.

1.5

Calling Hours. Federal law (47 C.F.R. § 64.1200(c)(1) and 16 C.F.R. § 310.4(b)(1)(iv)) generally prohibits telemarketing calls before 8:00 a.m. or after 9:00 p.m. local time of the called party. Many states impose additional or more restrictive calling hour requirements. Customers are responsible for configuring Callengo campaign scheduling to respect the local timezone of each Contact and comply with all applicable time-of-day restrictions.

1.6

Call Recording Consent by State. Callengo records all calls by default as a core part of the platform's functionality. Call recording consent laws vary significantly by jurisdiction. The following U.S. states require the affirmative consent of all parties to a telephone call before the call may be lawfully recorded:

State	Governing Law	Key Notes
California	Cal. Penal Code § 632	Civil penalty of $5,000 per violation; criminal penalties apply
Florida	Fla. Stat. § 934.03	Both civil and criminal liability
Illinois	720 ILCS 5/14-2	Criminal penalties apply
Maryland	Md. Code, Courts § 10-402	All-party consent required
Massachusetts	Mass. Gen. Laws ch. 272, § 99	Criminal penalties apply; among the strictest states
Michigan	Mich. Comp. Laws § 750.539c	All-party consent required
Montana	Mont. Code § 45-8-213	All-party consent required
New Hampshire	N.H. Rev. Stat. § 570-A:2	All-party consent required
Oregon	Or. Rev. Stat. § 165.540	All-party consent required
Pennsylvania	18 Pa. Cons. Stat. § 5704	Among the most stringent recording laws in the US
Washington	RCW 9.73.030	Civil penalty of $100/day or $1,000 per violation

Customers placing calls to contacts in all-party consent states must configure their AI Voice Agent scripts to include a legally sufficient recording consent disclosure at the beginning of each call, such as: "This call may be recorded for quality assurance purposes." Callengo makes no warranty that any particular disclosure language satisfies the recording consent requirements of any specific jurisdiction.

1.7

AI Voice Agent Disclosure Requirements. Federal and state law in multiple jurisdictions requires disclosure of the automated or AI nature of outbound calls. California Business & Professions Code § 17512 requires that any call using an automated system clearly disclose its automated nature at or near the beginning of the call. The EU AI Act (Regulation (EU) 2024/1689) requires that persons interacting with an AI system be informed they are interacting with AI, unless this is obvious from context. Customers are solely responsible for determining which disclosure requirements apply to their campaigns and for configuring AI Voice Agent scripts accordingly. Callengo recommends that all customers configure agents to identify themselves as AI assistants at the beginning of every call.

1.8

Platform-Level Technical Safeguards. In addition to customer compliance obligations, Callengo enforces the following technical limits:

▸Contact Cooldown. A minimum interval is enforced between successive calls to the same contact number. Any attempt to call the same contact within this window is automatically blocked.
▸Concurrent Call Limits. Each account is limited to a maximum number of simultaneous calls based on its Subscription Plan, preventing bulk mass-calling of an individual contact list.
▸Daily and Hourly Rate Limits. Platform-level daily and hourly call volume limits are applied per account to prevent sustained high-frequency calling.

These technical controls do not substitute for customer compliance obligations and are not a guarantee of legal compliance.

02FTC Telemarketing Sales Rule (TSR)

The Federal Trade Commission's Telemarketing Sales Rule (16 C.F.R. Part 310) applies to telemarketing calls and imposes the following requirements on customers who use Callengo for telemarketing purposes:

▸Required Disclosures. For any outbound call that constitutes telemarketing, the TSR requires prompt disclosure at the beginning of the call of: the identity of the seller; the fact that the purpose of the call is to sell a product or service; and the nature of the product or service being offered.
▸Call Abandonment Rate. The TSR prohibits abandoning outbound telemarketing calls at a rate exceeding 3% of all calls answered by a live person per campaign, measured over a 30-day period.
▸Caller ID Transmission. Callers must transmit accurate caller ID information, including a callback telephone number. Blocking or falsifying caller ID is prohibited.
▸Do Not Call Compliance. Telemarketers must honor both the National DNC Registry and customer-specific do-not-call requests as described in Section 1.4.
▸Prohibited Practices. The TSR prohibits misrepresenting any material aspect of a product or service, the nature of the sales offer, or the identity of the caller.

Whether a particular Callengo campaign constitutes telemarketing under the TSR depends on the purpose and content of the calls. Customers are responsible for determining whether the TSR applies to their campaigns and for configuring campaigns to comply.

03GDPR Compliance: General Data Protection Regulation

3.1

Applicability. The General Data Protection Regulation (Regulation (EU) 2016/679) applies to Callengo on the following bases: (a) the sole member and manager of Fuentes Digital Ventures LLC resides in Valencia, Spain, an EU member state; given that the individual who exercises effective management and control of the company does so from within the EU, Callengo may be considered to have an establishment in Spain within the meaning of GDPR Article 3(1); and (b) where Callengo's services are offered to EU-based customers or where EU residents' personal data is processed through the platform, GDPR Article 3(2) applies. The GDPR therefore applies to Callengo's processing activities, and we operate in compliance with its requirements.

3.2

Role Definitions. With respect to personal data of Callengo's own business customers and their team members (account holder data, usage data, billing data), Callengo is the data controller. With respect to Contact data uploaded by business customers for use in calling campaigns, Callengo is a data processor acting on behalf of the customer (the data controller). Callengo processes Contact data only on documented instructions from the customer, only for the purpose of executing the campaign, and subject to the obligations set out in the Data Processing Addendum.

3.3

Data Processing Agreement (DPA). Callengo provides a Data Processing Addendum (DPA) that governs the processing of personal data by Callengo on behalf of its business customers, in accordance with GDPR Article 28. The DPA is available at callengo.com/legal/dpa and is incorporated by reference into the Terms of Service. Enterprise customers who require a custom DPA should contact legal@callengo.com.

3.4

Legal Bases for Processing. Callengo processes personal data of its customers and their team members under the following legal bases:

Processing Activity	Legal Basis	GDPR Article
Account and service delivery	Performance of contract	Art. 6(1)(b)
Billing and payment processing	Performance of contract	Art. 6(1)(b)
Transactional communications	Performance of contract	Art. 6(1)(b)
Security monitoring and fraud prevention	Legitimate interests	Art. 6(1)(f)
Product analytics (Application)	Legitimate interests	Art. 6(1)(f)
Website analytics (non-essential cookies)	Consent	Art. 6(1)(a)
Marketing communications	Consent	Art. 6(1)(a)
Legal compliance	Legal obligation	Art. 6(1)(c)
Financial record retention	Legal obligation	Art. 6(1)(c)
Processing Contact data on behalf of Customers	Customer instruction (processor)	Art. 28

3.5

Data Subject Rights. EU and EEA residents have the following rights with respect to their personal data processed by Callengo as data controller:

Right	GDPR Article	How to Exercise
Right of access	Art. 15	Email privacy@callengo.com
Right to rectification	Art. 16	Account Settings or privacy@callengo.com
Right to erasure	Art. 17	Email privacy@callengo.com
Right to restriction of processing	Art. 18	Email privacy@callengo.com
Right to data portability	Art. 20	Data export in Account Settings
Right to object	Art. 21	Email privacy@callengo.com
Right to withdraw consent	Art. 7(3)	Cookie Settings or privacy@callengo.com
Right to lodge a complaint	Art. 77	Agencia Española de Protección de Datos (AEPD), aepd.es

We respond to data subject rights requests within 30 days of receipt. Where requests are complex or numerous, we may extend this period by an additional 60 days with prior notice.

3.6

International Data Transfers. Personal data processed by Callengo may be transferred to and stored in the United States. We ensure such transfers comply with GDPR Chapter V using the following mechanisms: (a) Standard Contractual Clauses (SCCs), Commission Implementing Decision (EU) 2021/914 (Module Two: Controller to Processor), incorporated into our DPA; and (b) the EU-US Data Privacy Framework, where our sub-processors are certified.

3.7

Sub-processor Management. Callengo maintains a current list of sub-processors at callengo.com/legal/sub-processors. We provide at least 30 days' advance notice of any new sub-processor or material change. Customers may object within 14 days of notification by contacting legal@callengo.com.

3.8

Lead Supervisory Authority. Given that the sole member and manager of Fuentes Digital Ventures LLC resides in Spain, the lead data protection supervisory authority is likely the:

Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6 · 28001 Madrid, Spain
www.aepd.es · +34 901 100 099

04CCPA / CPRA Compliance: California Consumer Privacy Act

4.1

Applicability. The California Consumer Privacy Act (Cal. Civ. Code §§ 1798.100–1798.199.100), as amended by the California Privacy Rights Act (CPRA), applies to businesses meeting certain annual revenue, data volume, or revenue composition thresholds. Callengo monitors its obligations under the CCPA as the platform grows. Regardless of formal CCPA applicability, Callengo honors California residents' privacy rights as a matter of policy.

4.2

Rights of California Residents. California residents have the following rights under the CCPA/CPRA:

▸Right to Know. Request disclosure of the categories and specific pieces of personal information we collect, the sources, business purposes, and categories of third parties with whom we share it.
▸Right to Delete. Request deletion of personal information we have collected, subject to certain exceptions.
▸Right to Correct. Request correction of inaccurate personal information.
▸Right to Opt-Out of Sale or Sharing. Callengo does not sell personal information. Callengo does not share personal information for cross-context behavioral advertising.
▸Right to Limit Use of Sensitive Personal Information. We limit our use of sensitive personal information (including IP addresses) to purposes necessary to provide the Service.
▸Right to Non-Discrimination. You will not be denied services, charged different prices, or treated differently for exercising your CCPA rights.

To submit a CCPA request, contact us at privacy@callengo.com. We will respond within 45 calendar days.

4.3

Service Provider Classification for Contact Data. When Callengo processes personal information of individuals on behalf of its business customers (Contact data used in campaigns), Callengo acts as a "service provider" under the CCPA. As a service provider, Callengo is prohibited from: retaining, using, or disclosing Contact data for any purpose other than performing the services specified in the agreement with the customer; combining Contact data from different customers; or using Contact data for Callengo's own commercial purposes. Callengo certifies its compliance with these restrictions in its Terms of Service.

4.4

Categories of Personal Information Collected. The following table summarizes the categories of personal information Callengo collects from its business customers:

Category	Examples	Purpose
Identifiers	Name, email address, IP address, account UUID	Account management, authentication, security
Commercial information	Subscription plan, billing history, usage records	Billing, service delivery
Internet or electronic network activity	Pages visited, features used, session data	Product improvement, security
Geolocation data	Country, region, city (derived from IP)	Currency and timezone display settings
Professional or employment-related information	Company name, job role, industry	Account setup, product customization
Inferences drawn from the above	Product usage patterns, feature preferences	Product improvement

05Data Security Posture

5.1

Security Measures. Callengo implements the following technical and organizational security measures to protect personal data:

Measure	Implementation
Encryption in Transit	All data transmitted between users and the platform uses TLS 1.2 or higher. HSTS is enforced with a minimum one-year max-age on all Callengo domains.
Encryption at Rest	OAuth access tokens and refresh tokens for all integration providers are encrypted using AES-256-GCM with a 256-bit key. Encryption keys are stored as protected server-side environment variables, never committed to source code.
Database Security	Row-level security (RLS) is enforced on all application database tables. Database-level triggers prevent privilege escalation and unauthorized modification of sensitive fields.
Authentication Controls	Passwords hashed with bcrypt; never stored in plaintext. Session tokens stored in HTTP-only, Secure, SameSite cookies not accessible to client-side scripts. TOTP-based MFA available to all users.
Access Controls	Service-level credentials that bypass RLS are used exclusively for server-side operations and stored as protected environment variables. Role-based access control limits data access by user role (Owner, Admin, Member).
Webhook Security	All inbound webhooks verified using HMAC-SHA256 before processing. All outbound webhook deliveries include HMAC-SHA256 signatures. Webhook URLs validated against SSRF protections blocking private IP ranges.
Security Headers	All Application responses enforce: Content Security Policy (CSP), X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, Permissions-Policy, and HSTS.
Administrative Audit Logging	Selected administrative actions are logged to an audit log recording the action, performing user, timestamp, IP address, and user agent.
Rate Limiting	Rate limiting is applied to sensitive API endpoints to prevent abuse and brute-force attacks.

5.2

Infrastructure Security. The Callengo platform is hosted on enterprise cloud infrastructure and serverless compute. All infrastructure components are located within the United States. Underlying infrastructure providers maintain SOC 2 Type II certifications. Infrastructure access is restricted to authorized personnel on a least-privilege basis. Automated database backups are maintained.

5.3

Limitations. While Callengo implements the above measures, no information security system is impenetrable. We cannot guarantee absolute security against all threats. In the event of a data breach, we will respond in accordance with our breach notification obligations described in Section 5.4.

5.4

Breach Notification. In the event of a personal data breach, Callengo will:

▸Assess the nature and scope of the breach and take immediate containment steps;
▸Notify affected EU/EEA residents and the relevant supervisory authority (AEPD) within 72 hours of becoming aware of the breach where required by GDPR Articles 33 and 34;
▸Notify affected Wyoming residents and, where applicable, the Wyoming Attorney General in accordance with the Wyoming Data Security Act (Wyo. Stat. §§ 40-12-501 et seq.);
▸Notify affected customers where their Customer Data has been accessed or disclosed; and
▸Maintain records of all security incidents, including those that do not require formal notification.

To report a security vulnerability or suspected breach, contact us immediately at legal@callengo.com.

06Data Retention Policy

6.1

Retention Principles. Callengo retains personal data only for as long as necessary to fulfill the purposes for which it was collected, to comply with legal obligations, and to resolve disputes and enforce agreements. We apply the following principles:

▸Necessity. We retain data only where there is an active business need or legal obligation.
▸Proportionality. Retention periods are proportionate to the sensitivity of the data and the purpose of processing.
▸Customer Control. Customers control the retention of their Contact data and Call Data within their account and may delete records at any time through the Application.

6.2

Retention Periods by Data Category.

Data Category	Default Retention Period	Notes
Account and profile information	Duration of account + 90 days	90-day window allows data export after closure
Contact records	Until deleted by Customer or account closure	Customer controls deletion via Application
Call logs and transcripts	Until deleted by Customer or account closure	Customer controls deletion via Application
Call recordings (basic)	30 days from call date	Default; deleted automatically after 30 days
Call recordings (Recording Vault add-on)	Up to 12 months (customer-configured)	Extended retention requires paid add-on subscription
AI analysis results	Retained with call log	Deleted when associated call log is deleted
Integration OAuth tokens	Deleted on integration disconnection	Immediate deletion upon disconnect
Billing and transaction records	Minimum 7 years	Required for tax and accounting compliance
Session and authentication logs	30 days	Rolling deletion
Security and audit logs	12 months	Rolling deletion
AI assistant conversations	Duration of account	Deleted on account closure
Cancelled account operational data	90-day export window, then deleted	Contacts, campaigns, integrations
Cancelled account financial records	Minimum 7 years	Billing history, invoices, usage records

6.3

Deletion Upon Account Closure. When a Callengo account is closed or cancelled: (i) immediately, campaign dispatch is disabled and integration access is revoked; (ii) within 90 days, customers may access and export their data; (iii) after 90 days, operational data (contacts, call records, campaign data, integration credentials, AI conversations) is permanently deleted; and (iv) retained indefinitely, billing history, transaction records, usage records, and other financial data required by applicable law. Customers are solely responsible for exporting any data they wish to retain before the 90-day export window expires.

6.4

Data Subject Deletion Requests. Callengo business customers who receive deletion requests from their contacts (the individuals called through campaigns) are responsible for processing those requests as data controllers. Callengo will assist customers in responding to data subject deletion requests in accordance with the Data Processing Addendum. When a contact record is deleted from the Callengo platform, the contact's personal identifiers are removed from the contacts table. Customers who wish to ensure full deletion of all related call records should delete those records separately through the Application or by contacting support.

07Acceptable Use Policy

Callengo is a legitimate business-to-business technology platform. The following uses of the platform are strictly prohibited:

7.1 Prohibited Calling Practices

▸Placing calls to any individual who has not provided legally required consent for the type of call being placed;
▸Placing calls to numbers registered on the National DNC Registry, any state DNC registry, or an internal DNC list, without a legal exemption or documented consent;
▸Using AI Voice Agents to deceive or impersonate any person, business, or government entity;
▸Using the platform for calls that constitute harassment, threats, or intimidation;
▸Using the platform to place spam calls, scam calls, or any calls with a fraudulent purpose;
▸Using the platform for debt collection in violation of the Fair Debt Collection Practices Act;
▸Using the platform to target individuals under the age of 18;
▸Using the platform for political robocalling in violation of applicable law; and
▸Configuring calling hours that violate federal or state time-of-day restrictions.

7.2 Prohibited Data Practices

▸Uploading contact lists obtained through deceptive means, purchased without adequate consent verification, or obtained in violation of any privacy or data protection law;
▸Processing protected health information (PHI) as defined under HIPAA — Callengo does not currently offer Business Associate Agreements and the platform must not be used for HIPAA-regulated workflows;
▸Processing payment card data subject to PCI DSS requirements through the platform;
▸Uploading data that infringes any third-party intellectual property right; and
▸Using the platform to build or contribute to a database of personal data for sale to third parties.

7.3 Prohibited Technical Practices

▸Attempting to circumvent rate limits, concurrent call limits, or other technical controls;
▸Reverse engineering, decompiling, or attempting to extract source code from the platform;
▸Using automated tools to scrape data from the platform;
▸Attempting to access another customer's data or system resources;
▸Uploading or transmitting malicious code, viruses, or other harmful software; and
▸Building a competing product using data or outputs from the platform.

Violations of this Acceptable Use Policy may result in immediate account suspension or termination without refund, and may be reported to applicable law enforcement or regulatory authorities. Callengo reserves the right to determine, in its sole discretion, whether a use constitutes a violation of this policy.

08HIPAA and Regulated Industry Notice

Callengo is not a HIPAA-compliant platform by default. The platform has not undergone HIPAA compliance certification and does not, in its standard configuration, satisfy the technical, physical, and administrative safeguard requirements of the HIPAA Security Rule.

Healthcare providers, health plans, healthcare clearinghouses, and their business associates are prohibited from using the Callengo platform to place calls to patients, process patient data, or handle any information that constitutes Protected Health Information (PHI) as defined under 45 C.F.R. § 160.103. Callengo does not currently offer Business Associate Agreements (BAAs) and cannot be used for HIPAA-regulated workflows.

For questions about healthcare use cases and future HIPAA support, contact legal@callengo.com.

Similarly, customers in other regulated industries (including financial services, subject to GLBA; legal, subject to attorney-client privilege and state bar rules; and education, subject to FERPA) are responsible for ensuring that their use of the Callengo platform complies with all industry-specific regulatory requirements. Law firm customers using the Clio integration should be aware that legal client data may be subject to heightened confidentiality obligations and should obtain ethics guidance before deploying AI calling to clients.

09CAN-SPAM Act

Callengo sends transactional emails to account holders (account verification, password reset, billing notifications, team invitations) from noreply@callengo.com. These emails are operational communications required to manage your account and are not commercial solicitations subject to CAN-SPAM's opt-out requirements. Any marketing or promotional emails Callengo sends include a clear unsubscribe mechanism and comply with applicable CAN-SPAM requirements.

Customers using the Callengo platform to send follow-up emails in connection with calling campaigns must independently ensure that such emails comply with the CAN-SPAM Act (15 U.S.C. §§ 7701 et seq.) and applicable state email marketing laws.

10Marketing Website Compliance

In addition to the platform-level compliance measures described above, Callengo implements the following compliance measures on its public marketing website (callengo.com) to protect visitor privacy and comply with applicable cookie consent and data protection regulations.

10.1

Google Consent Mode v2. The Callengo website implements Google Consent Mode v2 in the root layout of the site. On every page load, consent defaults are set as follows: analytics_storage: denied, ad_storage: denied, ad_user_data: denied, ad_personalization: denied. A wait_for_update: 500 parameter ensures that the consent management platform has time to load before any tags fire. This means no analytics or advertising cookies are set until the visitor explicitly grants consent. This implementation is required by Google for GDPR-compliant use of Google Analytics and Google Ads tags.

10.2

Usercentrics Consent Management Platform (CMP). Callengo uses Usercentrics, an EU-based Consent Management Platform (hosted at app.usercentrics.eu), to manage cookie consent for all website visitors. Usercentrics presents a cookie consent banner on first visit and manages the following consent categories:

▸Functional. Cookies strictly necessary for the website to operate (always active; no consent required).
▸Analytics. Cookies used to measure website traffic and visitor behavior (e.g., Google Analytics 4). Requires explicit consent.
▸Marketing. Cookies used for advertising attribution and retargeting (e.g., LinkedIn Insight Tag, HubSpot tracking). Requires explicit consent.

Usercentrics integrates with Google Tag Manager (GTM) to gate all tracking tags behind consent signals. Tags for GA4, HubSpot, and LinkedIn fire only after the visitor has granted the corresponding consent category. The Usercentrics CMP is compliant with the GDPR, the ePrivacy Directive, CCPA, and IAB Transparency and Consent Framework (TCF) v2.2.

10.3

Cookie Consent Flow. The website's cookie consent flow operates as follows:

▸Page loads and Google Consent Mode v2 sets all storage types to denied by default;
▸Usercentrics CMP loads and displays the cookie consent banner to the visitor;
▸If the visitor consents: Usercentrics updates consent via gtag('consent', 'update', ...), and GTM processes the retained tags, enabling GA4, HubSpot, and LinkedIn tracking;
▸If the visitor rejects: all non-essential cookies remain blocked, and only functional cookies are active;
▸Visitors can change their cookie preferences at any time by clicking the "Cookie settings" button in the website footer, which opens the Usercentrics preference panel.

10.4

Third-Party Services on the Website. The following third-party services are used on the Callengo marketing website. All services that set non-essential cookies or collect personal data are gated behind the Usercentrics consent mechanism described above:

Service	Purpose	Consent Required
Google Tag Manager (GTM-MXFGV52S)	Tag orchestration and consent-gated tag loading	No (tag container only; does not set cookies)
Google Analytics 4	Website analytics and visitor behavior measurement	Yes (Analytics category)
HubSpot (portal 147914572, EU1 region)	CRM, forms, and marketing tracking	Yes (Marketing category)
LinkedIn Insight Tag	Advertising attribution and audience insights	Yes (Marketing category)
Usercentrics CMP	Cookie consent management (EU-based)	No (consent tool itself)
Google Fonts	Typography (loaded from fonts.googleapis.com)	No (functional)
Vercel	Website hosting platform	No (infrastructure)

10.5

ePrivacy Directive Compliance. The ePrivacy Directive (Directive 2002/58/EC, as amended by Directive 2009/136/EC) requires prior informed consent before storing or accessing non-essential cookies on a visitor's device. The Callengo website satisfies these requirements by:

▸Displaying a cookie consent banner before any non-essential cookies are set;
▸Providing granular consent categories so visitors can choose which types of cookies to accept;
▸Allowing easy withdrawal of consent at any time via the "Cookie settings" button in the website footer;
▸Defaulting all non-essential storage types to denied until explicit consent is obtained; and
▸Maintaining a record of consent decisions through the Usercentrics platform.

10.6

Website Data Processing. Personal data collected through the Callengo marketing website is processed as follows:

▸HubSpot CRM. Contact form submissions and newsletter signups are processed by HubSpot, which is hosted in the EU1 region (eu1.hubspot.com). This ensures that personal data submitted through the website is stored and processed within the European Union.
▸Newsletter Subscriptions. The newsletter signup flow uses the HubSpot Contacts API v3 with the hs_marketable_status: true property, which represents explicit GDPR-compliant opt-in for marketing communications.
▸Analytics Data. Google Analytics 4 and HubSpot tracking are gated behind consent mode, ensuring no personal data is collected for analytics purposes without the visitor's explicit consent.

11Email Marketing Compliance

11.1

CAN-SPAM Act Compliance (Outbound Marketing Email). In addition to the transactional email compliance described in Section 9, Callengo uses Smartlead for outbound cold email marketing campaigns. All outbound marketing emails sent by or on behalf of Callengo comply with the CAN-SPAM Act (15 U.S.C. §§ 7701 et seq.) by:

▸Including a clear and conspicuous unsubscribe link in every marketing email;
▸Honoring unsubscribe requests within the required timeframe;
▸Accurately identifying the sender and including valid physical postal address information;
▸Using truthful and non-deceptive subject lines; and
▸Not using harvested or purchased email addresses without adequate consent verification.

11.2

GDPR-Compliant Email Marketing. All email marketing to EU/EEA residents is conducted on a consent basis (GDPR Article 6(1)(a)). The following measures are in place:

▸Explicit Opt-In. Newsletter subscriptions require explicit opt-in. The HubSpot marketable status property is set to true only upon affirmative consent by the subscriber.
▸Marketable Status Management. HubSpot manages the marketable status of all contacts. Contacts who unsubscribe are immediately marked as non-marketable and excluded from future campaigns.
▸EU Data Processing. All newsletter and marketing contact data is processed through HubSpot's EU1 data center, ensuring personal data remains within the European Union.
▸Right to Withdraw. Recipients can withdraw consent at any time by clicking the unsubscribe link or by contacting privacy@callengo.com.

12Compliance Contact and Reporting

For compliance-related inquiries, to report suspected violations, or to exercise data subject rights, please contact:

EntityFuentes Digital Ventures LLC

BrandCallengo

Address5830 E 2nd St, Ste 7000 #20312, Casper, WY 82609, United States

Legal & Compliancelegal@callengo.com

Privacy Requestsprivacy@callengo.com

US Telemarketing Compliance Resources

FTC National DNC Registryhttps://www.donotcall.gov

FCC TCPA Informationhttps://www.fcc.gov/consumers/guides/stop-unwanted-robocalls-and-texts

FTC Telemarketing Sales Rulehttps://www.ftc.gov/legal-library/browse/rules/telemarketing-sales-rule

EU / EEA Data Protection Authority

Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6 · 28001 Madrid, Spain
www.aepd.es

This page was last updated on March 27, 2026. Nothing on this page constitutes legal advice. Customers are solely responsible for ensuring that their use of the Callengo platform complies with all applicable laws and regulations.

Questions about compliance?

Our legal and compliance team is available to help. Reach out for detailed information about our practices, to request a DPA, or to discuss enterprise compliance requirements.

legal@callengo.com