Business Communications Policy

We build communications infrastructure for operations — transactional alerts, customer support, and consent-based notifications. We do not build mass-marketing tooling. This policy makes that posture explicit.

The intent is to give partners, providers (including Meta), regulators, and customers a clear picture of how communications are operated across our platforms.

This policy applies to any communication initiated through, routed by, or facilitated by a Cargavia Technologies platform. That includes communications sent on behalf of users of our platforms (for example, businesses using Mandivo to communicate with their customers) and direct communications from Cargavia Technologies to its own users.

The principles below describe how our platforms operate communications by default:

• Consent-based. Recipients must have opted in to receive communications in a specific, informed, voluntary way.
• Identifiable. Senders must be accurately identified. Hiding or disguising the sending business is not permitted.
• Operational. Communications are tied to a real operational purpose — an order, an account, a support conversation, an expected notification.
• Reciprocal. Recipients can stop or change communications at any time through a clear, low-friction control.
• Governed. Messaging activity is monitored for quality, compliance, and abuse — both by us and by our upstream providers.

Before sending any communication that requires consent — including marketing messages and most WhatsApp messages — users of our platforms must:

• Obtain explicit, informed, voluntary opt-in from each recipient.
• Make the scope of opt-in clear (the sending business, the kinds of messages, and the relevant channel).
• Record the source, timestamp, and (where relevant) wording of the opt-in.
• Obtain channel-specific consent. Opt-in for one channel (e.g., email) does not authorize messaging on another channel (e.g., WhatsApp).
• Refresh consent where required by law or by an applicable provider policy.

Purchased contact lists, scraped contact lists, and consent collected on behalf of an undisclosed third party are not acceptable bases for messaging through our platforms.

The following categories are permitted, subject to the rest of this policy:

• Transactional & operational messages. Order confirmations, shipment updates, appointment reminders, account alerts, security notifications, and other messages a recipient reasonably expects to receive about a transaction or account.
• Customer support communications. Two-way conversations initiated or expected by the recipient.
• Consent-based marketing & notifications. Marketing or informational messages where valid, demonstrable opt-in has been collected and is current.
• Compliance & safety messages. Notifications required by law, regulation, or platform-safety obligations.

The following practices are prohibited on all Cargavia Technologies platforms. This list is not exhaustive — see also our Acceptable Use Policy.

• Sending bulk or unsolicited messages without valid, demonstrable opt-in.
• Using purchased, rented, scraped, or otherwise non-consensual contact lists.
• Deceptive messaging — including misleading subject lines, fake notifications, disguised marketing, or impersonation of any business, brand, or government entity.
• Phishing, fraudulent collection of credentials or payments, and adjacent scams.
• Sending content that violates applicable law or that targets recipients for harassment.
• Disguising the sending business — including "sender renting" arrangements where one business operates under another business's name to obscure its activity.
• Evasion of provider rate limits, quality requirements, or template-approval processes through any technical or organizational technique.
• Continuing to message recipients who have asked to stop or who have not engaged after reasonable attempts.
• Using AI or automation to generate communications that would violate any rule in this policy.

Across our platforms, communications activity is governed through:

• Templates and approvals. Templated messages are reviewed before use on channels that require it (such as WhatsApp Business templates).
• Rate and quality monitoring. Sending behavior is monitored for spikes, quality indicators, and abuse patterns. We apply throttling, restrictions, or suspensions in response to abnormal patterns.
• Audit trail. Consent events, opt-out events, and message activity are logged in a form that supports investigations and partner reviews.
• Human oversight of automation. Automated and AI-assisted workflows are configured with monitoring and override controls.

When we operate communications on top of third-party providers — including Meta's WhatsApp Business Platform, email service providers, and SMS providers — we comply with the policies of those providers. If a provider policy and this policy address the same conduct, the stricter rule applies. If a provider policy is updated, the updated provider policy applies regardless of whether this page has been updated to reflect the change.

You must provide and honor clear opt-out controls on every channel where consent-based communications are sent. Honoring opt-out includes:

• Recognizing common opt-out phrases in the recipient's language.
• Recording the opt-out event and ceasing further non-essential messages.
• Respecting opt-out across the relevant brand and business unit, not just the specific campaign in which the opt-out was received.

Messages must accurately identify the business sending them. Branded sender names, email "from" addresses, business profiles, and templated content must reflect the real business behind the message. Reviewers, recipients, and providers should be able to determine who is sending a message and on whose behalf.

Automation and AI-assisted features are powerful operational tools and they are not a loophole. AI-generated or automated communications must:

• Comply with this policy and all referenced provider policies.
• Be transparent with recipients about the nature of the interaction, where required by law or where it would otherwise be misleading.
• Stay within the scope of the original opt-in. Automation is not a basis to expand into unrelated messaging.
• Operate under monitoring and human-review controls appropriate to the use case.

Violations of this policy, of any provider policy, or of our Acceptable Use Policy may result in any of the actions described in our AUP, including warnings, rate limiting, template revocation, suspension or termination of accounts, removal of workflows, cooperation with providers (such as Meta), and cooperation with applicable authorities.

We may act without prior notice where required to protect recipients, an upstream provider's platform, or the integrity of our services.

If you believe someone is using a Cargavia Technologies platform to communicate in violation of this policy, report it to abuse@cargavia.com. If you are a recipient and you want messages from a specific business to stop, reply STOP (or the equivalent in your language) to that business; you may also contact us if the sender does not honor your request.

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page. We may apply updated rules immediately where needed to align with provider requirements or to address abuse.

General questions can be sent to info@cargavia.com. Abuse reports should be sent to abuse@cargavia.com. Direct line: +1 (833) 399-0769.