Draft — not legal advice; to be reviewed by a qualified lawyer before publishing.

Acceptable use policy

Version: 2026-10-31 (draft) Effective date: [EFFECTIVE DATE — set when published] Last updated: 31 October 2026 · All changes

Castling by Cakraya is operated by Cakraya ([COMPANY LEGAL NAME]; exact registered form and SSM registration pending). This policy forms part of the Terms of service and applies to users, workspace members, agents, runners, connected apps and automation acting on their behalf.

1. Message people with permission

Do not send spam, bulk unsolicited messages, deceptive promotions or repeated unwanted contact. Do not buy, harvest or upload scraped contact lists. Message only recipients you are entitled to contact, using consent or another basis permitted by the applicable law and platform. A previous conversation, an imported address book or access to a number is not blanket permission for marketing.

Broadcast tools are for permitted messages to an appropriately opted-in audience. A Castling opt-in flag, rate limit or unsubscribe footer does not by itself establish legal consent or platform permission. Use the official business connection when required; an unofficial linked-device connection does not authorise activities prohibited by WhatsApp.

2. Respect opt-outs

Honour STOP and equivalent requests promptly, including requests in ordinary language or made outside Castling. Do not move an opted-out contact to another number, channel or list to continue marketing without a valid new permission. Keep only the minimum suppression record needed to respect the request, subject to applicable law.

Castling recognises certain opt-out commands, including STOP, BERHENTI and UNSUBSCRIBE, in its supported WhatsApp flows. You remain responsible for monitoring all requests, updating connected systems and stopping unwanted messages; do not assume every language, spelling or channel is detected automatically. Do not re-enable a recipient without their valid renewed permission.

3. Use your own identity and authorised data

Do not impersonate another person, business or public body, misrepresent your authority, commit fraud or use a compromised account. You may authorise replies in your own identity or for a business you represent, including your own writing style, only when lawful and permitted by the platform. Make required disclosures about automated or AI communication; do not use style imitation to deceive people about another person's involvement.

Do not scrape accounts, messages, profiles or other information, bypass access restrictions, extract another member's private data, or use Castling to surveil people without authority. Import only information you have a right to process and share with the selected agents/providers. Protect third-party privacy, confidentiality and intellectual property.

4. No unlawful or harmful use

Do not use Castling to create, distribute or facilitate illegal content or activity, child sexual exploitation, threats, harassment, unlawful discrimination, trafficking, violence, fraud, malware, credential theft or other abuse. Do not infringe copyright or other rights. Do not instruct an agent to evade these rules or delegate prohibited activity to another agent, runner or service.

Review AI output and automation settings. Do not rely on automated replies or inferred CRM labels for unlawful or unreviewed decisions that significantly affect people's rights. Keep a person available where the situation requires human judgment.

5. Respect platform and service limits

Follow WhatsApp/Meta, Telegram, TikTok, AI-provider and other applicable terms, messaging windows, template requirements and permission scopes. Respect Castling's limits, pauses, approvals and safety controls. Do not rotate numbers, create duplicate accounts, falsify opt-ins or bypass throttling, anti-abuse measures, billing or access checks.

Linked-device automation can result in restriction or loss of the WhatsApp number even when messages are paced. Official API access is also subject to enforcement. Limits reduce some risks; they are not a promise of delivery, compliance or protection from bans.

6. Reports and enforcement

Report suspected abuse to [CONTACT EMAIL], giving enough context to investigate without including unnecessary private messages or secrets. We may investigate, limit automation, suspend a connection or account, preserve necessary evidence or make legally required disclosures. Enforcement and account closure follow the Terms; removing access does not automatically erase all retained data. See the Privacy policy for current retention and rights-request procedures.

We may update this policy with notice of material changes as described in the Terms. Contact Cakraya at [CONTACT EMAIL] or [ADDRESS].