Compliance

Compliance that runs on every text and call

The rules that protect your leads and your license are built into Warmline's code. No script, campaign or setting can switch them off.

Consent

Every lead's consent is stored with the exact wording they agreed to, when, where and from what source.
No AI call or marketing text goes out without usable consent on file. Leads without it are listed for you to decide.
Old-lead campaigns sort leads by the consent on file and only contact the ones it allows.

STOP, QUIT, CANCEL, UNSUBSCRIBE, END, REVOKE, OPT OUT, or a plain "please stop texting me" ends every text and call immediately.
An opt-out on one channel stops every channel and every campaign.
The lead gets one confirmation text, then nothing.

Texts and calls only go out between 9 am and 8 pm in the lead's own time zone, in every state.
At most 3 attempts per person in any 24 hours, plus caps on unanswered follow-ups.
Every attempt, and every attempt that was skipped, is logged with the reason.

Data is encrypted in transit and at rest.
The CRM key each customer connects is encrypted again by the app before it's stored.
We don't sell personal information.

The assistant says it's an AI at the start of every call and whenever it's asked.
Calls are recorded and transcribed so you can review them, and the recording is announced on the call.
The assistant never quotes rates, APRs, pricing or approval odds; those questions go to you, the licensed professional.

Access is enforced inside the database itself, not just by the app's screens.
Each licensed professional sees their own leads, assistants see the people they support, managers see their team, and admins see their company.

These companies handle data on Warmline's behalf so the product can run. We don't sell personal information.

Supabase: Database and file storage for leads, conversations and account data.
Vercel: Hosts the Warmline website and app.
Retell: Runs the AI voice calls, including recording and transcription.
ElevenLabs: Provides the AI voices used on calls.
OpenAI: The AI model that writes text replies and checks replies for opt-outs. OpenAI doesn't train on our data, and we ask it not to keep conversations (abuse-monitoring logs are kept up to 30 days by default).
Sendblue: Sends and receives text messages (iMessage with SMS fallback).
Twilio: Phone calls and call transfers.
Inngest: Runs scheduled follow-up jobs at the right time.
Sentry: Error reports from the app, so problems get fixed fast. Phone numbers, emails, names, message text, cookies and keys are scrubbed before anything is sent.
Langfuse: Traces of the AI's decisions and test runs, to check its quality. Personal data is masked first: lead messages, names, phone numbers and emails are never sent.