8x Acceptable Use Policy — Rep Cold-Outreach Conduct

Last updated: June 2026

1. Purpose and binding effect

This Acceptable Use Policy ("AUP" or "Policy") governs how every person engaged by 8x Social, Inc., a Delaware corporation ("8x", "we", "us") to make outbound sales contact ("you", "Rep") may use the 8x platform, its dialer, and any data made available through it. The platform recruits and trains sales reps, who are engaged as independent contractors (not employees) prior to promotion, to place real outbound cold calls and outreach to real business prospects and earn performance-based pay (booking, AI-qualified meeting, and closed-deal milestones).

This Policy is contractually binding. By using the 8x dialer, accepting leads, or placing any outreach through 8x, you agree to this Policy as a condition of your engagement and of any pay. It is incorporated by reference into your independent-contractor agreement, the 8x Terms of Service (see terms-of-service.md), and is read together with the 8x privacy notices (see privacy-notice-reps.md and privacy-notice-prospects.md) and the recording-disclosure scripts (see call-recording-disclosures.md).

This Policy exists for two reasons:

Legal compliance. 8x is the data controller for both Rep data and prospect data, and 8x relies (outside India) on a documented legitimate-interest basis for B2B prospecting (see the legitimate-interest assessment in internal-compliance-artifacts.md). That basis, and 8x's anti-spam / Do-Not-Call ("DNC") / TCPA posture, only hold if Reps actually behave as described here. Your conduct is therefore the operational backstop for 8x's lawful basis.
Trust and brand. Prospects are real third parties who did not ask to be contacted. How you treat them is how 8x is judged.

Failure to follow this Policy can void 8x's compliance posture and exposes both you and 8x to legal liability. Breach has consequences for you, up to and including removal and forfeiture of disputed pay (Section 12).

2. Who and what this covers

Who: every Rep (applicant, audition-passed cold caller, and promoted closer), regardless of country, who places calls or sends outreach through 8x.
What: all outbound voice calls placed through the 8x/Twilio dialer; all outreach email sent through or on behalf of 8x; all notes, dispositions, and uploaded data; and any handling of prospect personal data accessed through the platform.
Where: the United States and the markets 8x serves — Brazil, Mexico, and India — plus any other country a lead originates from. Region-specific rules appear in Section 11. Where regional rules conflict, the stricter rule applies.

EU/UK IS in scope — GDPR and the ePrivacy Directive apply. 8x accepts EU scope (there is no EU-exclusion gate). EU/UK prospects bring GDPR and ePrivacy prior-consent rules into scope: electronic/automated direct marketing to EU prospects requires prior consent under ePrivacy Art. 13 (a legitimate-interest assessment does not clear it), and the EU-facing obligations (Art. 27 EU representative, SCCs Module 2 + TIA for US transfers, DPIA, Art. 22 automated-decision rights) are in force (see privacy-notice-prospects.md and the DPIA in internal-compliance-artifacts.md).

3. Core conduct rules (apply everywhere)

You must:

Identify yourself truthfully. State, at minimum, your name, that you are calling on behalf of 8x (and the client or campaign you are representing, as 8x directs), and the purpose of the call. Never disguise, spoof, or misrepresent who is calling or why.
Use the approved recording-disclosure script before recording or as the script directs (Section 6).
Honor every objection and opt-out immediately (Section 5).
Respect calling-hours limits for the prospect's location (Section 4).
Only contact numbers and people you are permitted to contact — i.e., not on any applicable DNC or suppression list (Section 4).
Only upload or enter data you have the right to use (Section 7).
Record your call outcome (disposition) accurately and honestly — including objections, opt-outs, wrong-number, and do-not-call requests — because suppression and compliance depend on it.

You must not:

Make any material misrepresentation about 8x, the client, the product, pricing, your identity, affiliation, or the reason for the call. Material misrepresentations are independently unlawful even where the call is otherwise exempt from telemarketing rules (US: 16 CFR 310.3(a)(2) and 310.3(a)(4)). This is the conduct 8x's AI conduct-flag system is built to catch (Section 8).
Harass, threaten, intimidate, abuse, or repeatedly call a prospect who has asked you to stop, or use profane/abusive language.
Re-dial or re-contact a prospect after they object or opt out (Section 5).
Record a call where recording is prohibited or where you have not given the required disclosure (Section 6).
Use the dialer for anything other than the assigned campaign — no personal calls, no calls to numbers you sourced outside 8x, no list 8x did not provide.
Attempt to evade, disable, or "game" recording, transcription, evaluation, suppression, or rate-limiting controls.
Share, export, sell, or repurpose prospect data for any purpose outside the assigned 8x campaign.

4. Who and when you may call: DNC, suppression lists, and calling hours

4.1 Suppression is mandatory — never call a suppressed number

You may only call numbers 8x serves to you through the dialer, and only if they have not been suppressed. You must not call a number that appears on any of the following, and you must not work around the platform to reach a suppressed contact:

Any applicable national / regulatory Do-Not-Call or do-not-disturb registry for the prospect's country (Section 11): US DNC framework; Brazil state Procon "Não Me Ligue" registries; Mexico REPEP; India TRAI / DND under TCCCPR.
8x's company-internal suppression list — every number ever flagged as do-not-call, opt-out, objection, wrong number, or litigation/complaint risk. This list is permanent and is honored across all campaigns.
Any client-provided suppression / exclusion list.

If the dialer ever presents a number you have independent reason to believe is suppressed, on a registry, or wrong, stop and report it rather than calling.

Registry scrubbing is primarily an 8x platform obligation: 8x scrubs against national registries and maintains the internal suppression list before serving numbers. This Policy binds the Rep not to defeat that control and to feed it accurate dispositions.

4.2 B2B vs. residential/cell — why you must honor DNC everywhere

Genuine business-to-business calls to real business lines are exempt from most US Telemarketing Sales Rule requirements (16 CFR 310.6(b)(7)) except the material-misrepresentation prohibitions. But that carve-out is narrow and unreliable in practice:

If a number you call is actually a residential or cell line, internal-DNC and calling-hours rules become mandatory, not best practice. You often cannot tell from the record, so 8x treats DNC discipline and calling-hours as mandatory on every call.
India, Brazil, and Mexico have no B2B carve-out. DNC/opt-out and consent rules apply regardless of whether the line is "business."

Policy: honor DNC, suppression, and opt-out on every call, in every country, with no exception for "it's a business line."

4.3 Calling hours

Place calls only within the permitted local calling window for the prospect's location, using the prospect's local time (the platform should surface this; if it does not, do not call outside a conservative window).

8x's default calling window is local 9:00–18:00 on business days only, no weekends or holidays. The US telemarketing baseline is 8:00–21:00 local; 8x's tighter business-hours default is intentional for B2B and to stay clear of residential rules. Tighter per-country windows (BR, MX, IN) may apply and are enforced through the dialer.

5. Objections and opt-outs — immediate, permanent suppression

This is the single most important rule in this Policy.

The moment a prospect indicates — in any words, in any language, by any clear signal — that they do not want to be contacted, do not want this product, want to be removed, or ask you to stop calling, you must:

Stop the pitch immediately. Do not argue, re-pitch, or try to "handle" a removal request as an objection to overcome.
Acknowledge and confirm you will remove them (use the approved opt-out wording — see call-recording-disclosures.md / opt-out-wording).
End the call unless they want something further.
Mark the disposition as opt-out / do-not-call so the number is added to 8x's permanent internal suppression list.
Never re-dial or re-contact that prospect again — not on this campaign, not on another, not by phone, not by email. Suppression is permanent and cross-channel.

This applies to email opt-outs as well: an unsubscribe or "stop emailing me" must be honored, and must be honored within 10 business days at the latest for US CAN-SPAM, but 8x's standard is immediate suppression (Section 9).

There is no quota exception to the opt-out rule. Continuing to contact someone after an opt-out is a serious breach (Section 12) and is independently unlawful in every market 8x serves.

6. Call recording and disclosure

Calls placed through 8x are recorded and then AI-transcribed and AI-evaluated (the evaluation can affect your pay — see Section 8 and the Privacy Policy). Because of this:

You must use the approved recording-disclosure script (see call-recording-disclosures.md) at the point it directs, before the substance of the call. Do not improvise, shorten, or skip it.
You must obtain the consent the script calls for. 8x's standard posture is all-party (two-party) consent as the safe baseline, because several US states require it (California Penal Code §§ 632 and 632.7 covering cellular/cordless calls; and roughly eleven to twelve all-party-consent states including CA, FL, PA, IL, WA, MD, MA, MT, NH, CT, and DE — each with its own nuances) and because the markets 8x serves expect clear notice. Express verbal consent to recording is the conservative requirement.
If a prospect refuses to be recorded, you must not proceed to record: end the call politely and disposition it as "declined recording." Because the AI evaluation that drives pay depends on a recording, there is no non-recorded call path.
Never record where recording is prohibited by the prospect's jurisdiction or by an explicit refusal.

Note for counsel: do not rely on any claim that an audible recording "beep" alone is or is not valid consent — that question was left open on remand in Smith v. LoanMe and must not be asserted as settled. The approved script is built around express verbal consent, which is the conservative posture.

7. Data you may upload, enter, or access

You may only put data into 8x that you have the right to use for this purpose, and you may only use prospect data for the assigned 8x campaign.

You must not:

Upload, paste, or enter personal data about any person that you obtained without a lawful right to use it for outreach (e.g., scraped lists, purchased lists 8x did not approve, contacts from a prior employer, or data covered by a confidentiality obligation).
Enter special-category / sensitive personal data into notes or any field — including health, race, religion, sexual orientation, political views, biometric identifiers, or financial-account data. Free-text notes are for business-relevant observations only. (Note: a plain voice recording is ordinary personal data, but voice-biometric identification is sensitive data and is prohibited — 8x does not build or use it, and you must not attempt to.)
Enter data about anyone other than the business prospect relevant to the campaign.
Export, copy, screenshot, or transmit prospect data outside the platform.

Keep free-text notes accurate, professional, and minimal. Notes are personal data, are retained, and may be disclosed to the prospect on a data-subject request.

8. AI evaluation, conduct flags, and your pay

Calls are transcribed and evaluated by an automated AI system against a defined rubric, and that evaluation determines whether a meeting is "qualified" and therefore whether you are paid (booking $15 / AI-qualified meeting $50 / closed deal $250 — see your contractor agreement and the Privacy Policy for how this automated decision-making works and your rights regarding it).

The same system raises conduct flags for behavior this Policy prohibits — for example, signs of material misrepresentation, harassment, missing recording disclosure, ignoring an objection, or contacting a suppressed number. Conduct flags are reviewed by a human.

An automated qualification/pay decision is subject to human review on request — you may contest any pay-affecting evaluation and have it reviewed by a person (see privacy-notice-reps.md, "Automated decisions about you", and the automated-decisions / contest procedure in internal-compliance-artifacts.md).
A conduct flag is a compliance matter and is handled under Section 12. Conduct flags are not about your sales skill; they are about whether you followed the rules in this Policy.

You must not attempt to manipulate, evade, or "game" the recording, transcription, evaluation, or flagging systems. Doing so is itself a breach.

9. Email and other outreach

If you send outreach email through or on behalf of 8x:

Header and sender information must be accurate — no false or misleading "from", "to", routing, or subject lines (US CAN-SPAM).
Each message must include a valid physical postal address (1111B S Governors Ave STE 47647, Dover, DE 19904, United States) and a working opt-out mechanism.
Honor opt-outs promptly — within 10 business days at the absolute latest under US CAN-SPAM, but 8x's standard is immediate suppression across phone and email.
Identify the message's commercial nature truthfully; no deceptive subject lines.
In India, Brazil, and Mexico, email/electronic outreach is additionally governed by the regional rules in Section 11 (e.g., India requires consent; do not treat email as exempt).

8x sends all outreach email centrally through the platform (Resend) from a single 8x-controlled address (The 8x Team <outreach@send.8x.sale>). Reps compose and send through the 8x composer; they do not send freehand email from their own mailboxes. Because 8x is the sender, the CAN-SPAM obligations above (accurate From/sender information, a valid physical postal address, and a working one-click opt-out) are implemented at the platform level — every outbound message carries the CAN-SPAM footer and List-Unsubscribe header, and an unsubscribe writes a permanent suppression that is honored on every subsequent send. (See sub-processors.md for the email processor; see privacy-notice-prospects.md § 9 for the prospect-facing opt-out/suppression mechanism.)

10. [Reserved]

[Placeholder retained so section numbering stays stable across counsel revisions; regional rules follow in Section 11.]

11. Region-specific rules

These rules are in addition to Sections 3–9. Where a regional rule is stricter, it controls. The country is determined by the prospect's location.

11.1 United States

Telemarketing Sales Rule (TSR): genuine B2B calls are exempt from most of the TSR (16 CFR 310.6(b)(7)) except the material-misrepresentation prohibitions (310.3(a)(2) and (a)(4)), which always apply — no false or misleading statements about any material fact. If a called number is actually residential or cell, full DNC and calling-hours rules apply.
DNC: honor the US Do-Not-Call framework and 8x's internal DNC/suppression list. Treat internal DNC and calling-hours as mandatory on every call.
TCPA / robocall framework: the platform's posture is built on prior express consent for any autodialed or prerecorded contact and on the DNC/robocall rules. Do not rely on any "one-to-one consent" rule — it was vacated by the Eleventh Circuit in January 2025 and must not be asserted.
Recording: all-party consent baseline; California §§ 632 / 632.7 and other all-party states (Section 6).
Email: CAN-SPAM (Section 9).

11.2 Brazil

Lawful basis: B2B prospecting relies on legitimate interest (LGPD Art. 7 IX / Art. 10) supported by a documented Legitimate Interest Assessment (see the LIA in internal-compliance-artifacts.md). Your conduct must keep the call within the scope of that assessment — minimal, relevant, respectful, and immediately stopped on objection.
Consumer Code (CDC): clearly identify the sender and honor opt-outs.
Do-not-call: scrub and honor state Procon "Não Me Ligue" registries (e.g., São Paulo Law 13.226/2008 as amended). (Do not reference Anatel "Não Me Perturbe" — that regime is telecom/financial-sector-specific and does not apply to 8x.)
Data-subject requests: prospects can exercise rights; LGPD requires a response within 15 days — route any request you receive to 8x immediately (see privacy-notice-prospects.md).
No sensitive data may ride on legitimate interest (LGPD Art. 11). Keep to ordinary business data (Section 7).

11.3 Mexico

A Spanish-language aviso de privacidad must be available to prospects (8x publishes this — see privacy-notice-prospects.md / aviso-de-privacidad). Direct the prospect there if asked.
Do-not-call: scrub and honor REPEP (Registro Público para Evitar Publicidad) under the consumer-protection law (LFPC, Art. 18 Bis); PROFECO enforces, with fines up to approximately MX$2.24M (Art. 127). Suppress REPEP-registered contacts and apply at least a 30-day suppression window.
Automated decisions: under Mexico's new data-protection law (in force 21 March 2025), a data subject may object to solely-automated processing producing "undesired effects" that evaluates behavior or performance — relevant to 8x's Rep evaluation, less to prospects, but flagged.
Honor objections/opt-outs as in Section 5. (Ordinary-data consent is tacit/opt-out by default; honor all opt-outs regardless.)

11.4 India

India's DPDP Act 2023 and DPDP Rules 2025 (notified 13 November 2025; substantive obligations phasing toward ~13 May 2027) are materially different from the other markets:

There is no legitimate-interest basis for cold outreach. Consent is required, and you generally cannot even cold-contact a person to obtain that consent.
A DPDP-itemized notice is not a substitute for consent.
Penalties reach up to ₹250 crore for the security-safeguards tier.

8x is aligning its India (+91) outreach to a consent-first approach and treats India activity as subject to Indian-counsel review before scaling. While outreach continues:

You must still honor every opt-out and do-not-call request from +91 / India prospects immediately and permanently (Section 5), and deliver the India recording disclosure (see call-recording-disclosures.md).
Telemarketing format rules: TRAI TCCCPR Second Amendment Regulations 2025 require use of the correct numbering series — 140-series for promotional and 1600-series for transactional calls — and honoring DND. The platform must place India calls only from compliant numbering; do not attempt India outreach from non-compliant numbers.

12. Consequences of breach

Compliance is a condition of your engagement and of your pay. 8x enforces this Policy through a graduated process, but reserves the right to escalate immediately for serious breaches.

Graduated enforcement (default):

Warning — for a first or minor breach (e.g., an isolated missed disclosure caught by review). Includes corrective guidance.
Suspension — temporary loss of dialer/lead access for repeated or more serious breaches, pending review.
Removal — termination of your engagement for serious or repeated breaches.

Immediate suspension or removal (no warning step) may apply to serious breaches, including:

Contacting a prospect after an opt-out / do-not-call request, or calling a suppressed or registry-listed number.
Material misrepresentation about identity, affiliation, product, or price.
Harassment, abuse, or threats.
Recording where prohibited or without the required disclosure.
Uploading data you had no right to use, or entering prohibited sensitive data.
Attempting to evade or game recording/transcription/evaluation/suppression controls.
Contacting India (+91) prospects in violation of the India rules in Section 11.4 (e.g., ignoring an India opt-out/DND, or dialing from non-compliant TRAI numbering).

Pay consequences. Pay is earned only for outreach conducted in compliance with this Policy. Pay tied to a call or meeting obtained through a breach of this Policy (for example, a "qualified meeting" secured by misrepresentation, or contact made after an opt-out) may be withheld, reversed, or forfeited. This is separate from, and does not limit, the human-review/contest right you have for automated evaluation of legitimately conducted calls (Section 8).

Process and fairness. 8x's default process is written notice of the alleged breach, an opportunity to respond before removal except in egregious cases, and a single internal appeal, read together with the termination terms of the Independent Contractor Agreement.

Nothing in this Section limits 8x's other rights or remedies, or any obligation 8x has to suppress, report, or cooperate with regulators.

13. Changes to this Policy

8x may update this Policy as law, processors, or operations change. Material changes will be notified to Reps by email or in-Platform notice, with re-acceptance required where the change is material. Continued use of the dialer after the effective date of a change constitutes acceptance. The current version and effective date appear at the top of this document.

14. Questions and reporting

If you are unsure whether something is allowed, ask before you act. If a prospect raises a privacy request, an opt-out you cannot complete, a complaint, or a legal threat, report it to 8x immediately so 8x can respond within the applicable deadlines.

Compliance / conduct questions: legal@8x.social
Privacy matters: privacy@8x.social

Cross-references

privacy-notice-reps.md / privacy-notice-prospects.md — controller disclosures, data-subject rights, automated decision-making, retention (rep and prospect notices)
call-recording-disclosures.md — approved recording disclosure and opt-out wording
sub-processors.md — recipients of personal data (Twilio, OpenAI, Anthropic, Supabase, Vercel, Resend, Cal.com, LinkedIn-intended)
internal-compliance-artifacts.md — legitimate-interest assessment (Brazil / US B2B basis), DNC/suppression policy (registry scrubbing + internal suppression list), and the human-review/contest process for automated evaluations
terms-of-service.md — platform terms this Policy is incorporated into