TCPA COMPLIANCE ADDENDUM

TABLE OF CONTENTS

1. Definitions
2. Scope and Applicability
3. Platform Classification Under TCPA
4. Consent Requirements
5. Prior Express Written Consent for Telemarketing
6. Do Not Call Compliance
7. Time of Day Restrictions
8. Caller Identification Requirements
9. Artificial and Prerecorded Voice Rules
10. Call Recording Compliance
11. Robocall Mitigation and STIR/SHAKEN
12. Record Keeping Requirements
13. Campaign-Specific Requirements
14. State-Level Requirements
15. Customer Obligations
16. Talkif's Role and Responsibilities
17. Compliance Monitoring and Enforcement
18. Penalties and Liability Allocation
19. Indemnification
20. Representations and Warranties
21. Suspension and Termination for Non-Compliance
22. Amendments and Regulatory Changes
23. Governing Law and Dispute Resolution
24. Appendix A: TCPA Compliance Checklist
25. Appendix B: Sample Prior Express Written Consent Form
26. Appendix C: Platform Technical Controls Reference
27. Appendix D: State-Specific Requirements Summary

1. DEFINITIONS

1.1 "Addendum" means this TCPA Compliance Addendum, which supplements and forms part of the Master Terms of Service (the "Agreement") between Talkif and Customer.

1.2 "Artificial Voice" means any voice generated by computer, AI, machine learning, text-to-speech technology, or any technology that produces speech without a live human speaker in real-time. All calls placed through Talkif's AI voice capabilities constitute calls using an Artificial Voice under TCPA.

1.3 "Autodialer" or "ATDS (Automatic Telephone Dialing System)" means any equipment that has the capacity to store or produce telephone numbers to be called using a random or sequential number generator, and to dial such numbers. For purposes of this Addendum, the Platform is treated as an ATDS because it stores telephone numbers in contact lists and campaigns and dials them automatically through programmatic API calls to telephony carriers, regardless of whether the numbers were generated randomly or sequentially. Customer acknowledges that the FCC and federal courts have interpreted ATDS broadly, and that the Platform's campaign and scheduling features meet the functional definition of an ATDS under the most conservative interpretation.

Note on Facebook v. Duguid (2021): The U.S. Supreme Court in Facebook, Inc. v. Duguid, 592 U.S. 395 (2021), narrowed the ATDS definition to require a random or sequential number generator. However, the Platform's use of artificial/prerecorded voice triggers separate TCPA provisions (47 U.S.C. Section 227(b)(1)(A)-(B)) that apply regardless of ATDS classification. The FCC has also signaled intent to address AI-generated calls under existing TCPA framework. Customer should NOT rely on the Duguid narrowing as a defense and must comply with all consent requirements outlined in this Addendum.

1.4 "Called Party" means the person or entity that receives a telephone call or message initiated through the Platform.

1.5 "Campaign" means a bulk calling operation configured through the Platform that places automated calls to a list of Contacts, as defined in the Platform's campaign management system (including campaign management, contact lists, call windows, and related scheduling configurations).

1.6 "Contact" means an individual whose telephone number is stored in the Platform's contact management system and who may be the recipient of calls placed through the Platform.

1.7 "Customer" means any person, business, or entity that has entered into the Agreement and uses the Platform to initiate telephone calls.

1.8 "DNC" or "Do Not Call" means a request by a Called Party to cease receiving telephone calls, whether made to the Customer directly, through the National Do Not Call Registry, or through any other mechanism.

1.9 "FCC" means the Federal Communications Commission of the United States.

1.10 "National DNC Registry" means the National Do Not Call Registry maintained by the Federal Trade Commission pursuant to 16 C.F.R. Part 310.

1.11 "PEWC" or "Prior Express Written Consent" means prior express written consent as defined in 47 C.F.R. Section 64.1200(f)(9), including the specific requirements set forth in Section 5 of this Addendum.

1.12 "Platform" means the Talkif software application, APIs, and related services that enable automated voice calling, including AI-powered conversations, campaign management, call scheduling, telephony integration, and all associated features.

1.13 "Prerecorded Voice" means any voice message that is recorded in advance of the call being placed. Under FCC guidance, AI-generated voice constitutes a prerecorded voice for purposes of TCPA compliance.

1.14 "Schedule" means a recurring call configuration that automatically places calls to one or more Contacts at specified times and intervals through the Platform's scheduling system.

1.15 "TCPA" means the Telephone Consumer Protection Act of 1991, as amended (47 U.S.C. Section 227 et seq.), together with all implementing rules and regulations promulgated by the FCC (47 C.F.R. Part 64), and all applicable FCC orders, declaratory rulings, and interpretive guidance.

1.16 "Telemarketing" means the initiation of a telephone call or message for the purpose of encouraging the purchase or rental of, or investment in, property, goods, or services, as defined by 47 C.F.R. Section 64.1200(f)(12). This includes calls that contain any commercial content, upsell or cross-sell offers, appointment scheduling for sales purposes, or calls that directly or indirectly promote commercial transactions.

1.17 "Talkif" means Talkif, Inc., a Delaware corporation, the operator of the Platform.

2. SCOPE AND APPLICABILITY

2.1 Incorporation by Reference. This Addendum is incorporated into and forms part of the Agreement. In the event of any conflict between this Addendum and the Agreement regarding TCPA compliance matters, this Addendum shall control.

2.2 Applicability. This Addendum applies to all Customers who use the Platform to place telephone calls to telephone numbers within the United States, its territories, and its possessions, regardless of where the Customer is physically located. The TCPA applies to calls made TO U.S. telephone numbers, not calls made FROM U.S. locations.

2.3 Minimum Compliance Obligation. Customer's use of the Platform to place automated or AI-powered calls constitutes an acknowledgment that the Customer has read, understood, and agreed to comply with all obligations set forth in this Addendum. Customer's failure to comply with these obligations may result in immediate suspension or termination of access to the Platform under Section 21.

2.4 Not Legal Advice. This Addendum is provided for informational and contractual purposes. Talkif is not a law firm and this Addendum does not constitute legal advice. Customer is solely responsible for obtaining independent legal counsel regarding TCPA compliance as it applies to Customer's specific use case, calling patterns, and industry.

2.5 Evolving Regulatory Landscape. TCPA regulation is actively evolving. The FCC issues new declaratory rulings, the courts issue new interpretations, and state legislatures enact new telemarketing statutes on an ongoing basis. Customer is responsible for monitoring and complying with all changes to applicable law, regardless of whether this Addendum has been updated to reflect such changes.

3. PLATFORM CLASSIFICATION UNDER TCPA

3.1 The Platform Uses Artificial/Prerecorded Voice. The Platform's core functionality generates AI-powered voice calls. Under the FCC's February 2024 Declaratory Ruling (CG Docket No. 02-278, FCC 24-17), AI-generated voice constitutes an "artificial or prerecorded voice" under 47 U.S.C. Section 227(b)(1). Every call placed through the Platform's AI voice features is subject to the TCPA's artificial/prerecorded voice restrictions.

3.2 The Platform Functions as an Autodialer. The Platform stores telephone numbers in database-backed contact lists and campaigns, and programmatically initiates calls through telephony provider APIs (including BYOC Trunk configurations). Whether or not this meets the post-Duguid ATDS definition, the use of artificial/prerecorded voice independently triggers TCPA restrictions under 47 U.S.C. Section 227(b)(1)(A) (calls to residential lines) and 47 U.S.C. Section 227(b)(1)(B) (calls to any line using prerecorded voice).

3.3 Customer is the "Caller" Under TCPA. For purposes of TCPA liability, the Customer is the "caller" or "initiator" of calls placed through the Platform. Talkif is a technology platform provider and is not the caller under the TCPA. However, Customer acknowledges that under FCC rules and federal court interpretations, vicarious liability may extend to parties who "had the right and authority to control" whether the calls were made, and that both Customer and Talkif have an interest in ensuring full compliance.

3.4 Shared Compliance Model. While Customer bears primary responsibility for TCPA compliance (including consent acquisition and DNC list maintenance), Talkif provides certain technical controls to support compliance (see Section 16 and Appendix C). Neither party's compliance obligations substitute for or diminish the other party's obligations.

4. CONSENT REQUIREMENTS

4.1 General Consent Framework. The TCPA establishes different consent tiers depending on the type of call, the type of telephone line called, and whether the call uses an artificial/prerecorded voice or autodialer:

4.2 Practical Implication for Platform Users. Because the Platform uses AI-generated voice (artificial/prerecorded voice) for all calls, Customer must obtain at minimum Prior Express Consent from every Called Party before placing any call through the Platform. For telemarketing calls, Customer must obtain Prior Express Written Consent (PEWC) as described in Section 5.

4.3 Customer's Consent Obligation. Customer must obtain and document all required consent BEFORE uploading contact information to the Platform or configuring any call, schedule, or campaign. The Platform does NOT verify, validate, or confirm that Customer has obtained the required consent. Customer bears sole and exclusive responsibility for:

(a) Determining the appropriate consent tier for each call based on the call's purpose, the type of telephone line, and applicable law;

(b) Obtaining consent that meets or exceeds the required tier before the call is placed;

(c) Documenting and retaining evidence of consent in a manner sufficient to prove consent in litigation or regulatory proceedings;

(d) Ensuring that consent has not been revoked, expired, or otherwise invalidated before placing each call;

(e) Verifying that the person who provided consent is the current subscriber or customary user of the telephone number to be called.

4.4 Consent Must Be Voluntary. Under 47 C.F.R. Section 64.1200(f)(9), consent to receive autodialed or prerecorded calls may NOT be a condition of purchasing any property, goods, or services. Customer must not require consent to automated calls as a prerequisite for any transaction, service, or benefit.

4.5 Consent is Phone-Number Specific. Consent must be obtained for the specific telephone number to be called. Consent to call one number does not constitute consent to call a different number belonging to the same person.

4.6 Consent is Caller Specific. The FCC adopted a "one-to-one consent" rule in its December 2023 order (FCC 23-107), which would have required consent to specifically name each individual seller. However, the Eleventh Circuit vacated this rule on January 24, 2025 in Insurance Marketing Coalition v. FCC. The FCC issued a stay order the same day, declined to challenge the ruling, and in September 2025 issued a final rule formally withdrawing the requirement. As a result, multi-seller consent forms remain legally permissible.

Notwithstanding the above, Talkif strongly recommends that Customer obtain one-to-one consent (consent that specifically names Customer as the authorized caller) as a best practice. One-to-one consent provides the strongest defense in TCPA litigation and reduces the risk of consent disputes. Customer should not rely on consent obtained by a third party, lead generator, or comparison shopping website without careful verification that the consent is valid and has not been revoked.

Note: While bundled/multi-seller consent is currently permissible, the regulatory landscape continues to evolve. The FCC or Congress may revisit one-to-one consent requirements in future rulemaking. Customer should monitor developments and consult legal counsel.

4.7 Reassigned Number Database. The FCC maintains a Reassigned Numbers Database (RND). When calling a number for which consent was obtained more than a reasonable time ago, Customer should query the RND to verify the number has not been reassigned. Calls to reassigned numbers are not protected by prior consent and may constitute TCPA violations. Customer is solely responsible for checking the RND.

4.8 Revocation of Consent. A Called Party may revoke consent at any time and through any reasonable means, including but not limited to verbal request during a call, text message, email, or any other method. Customer must honor revocation immediately and must have systems in place to process and record revocations. Any call placed after revocation is a violation regardless of the original consent.

5. PRIOR EXPRESS WRITTEN CONSENT FOR TELEMARKETING

5.1 When PEWC Is Required. Prior Express Written Consent is required for all telemarketing calls made using an autodialer or artificial/prerecorded voice to any telephone number (residential or wireless). Because the Platform uses AI-generated voice, PEWC is required for ALL telemarketing calls placed through the Platform.

5.2 Elements of Valid PEWC. Under 47 C.F.R. Section 64.1200(f)(9), valid PEWC must include ALL of the following elements:

(a) Written agreement -- The agreement must be in writing, which includes electronic agreements (e-signatures are acceptable under the E-SIGN Act);

(b) Signature -- The agreement must be signed by the person being called. Electronic signatures are acceptable if they comply with E-SIGN Act requirements (15 U.S.C. Section 7001 et seq.);

(c) Clear and conspicuous disclosure -- The agreement must clearly and conspicuously disclose that:

• The person is authorizing the specific seller identified by name to deliver or cause to be delivered telemarketing messages;
• The messages will be delivered using an automatic telephone dialing system or an artificial or prerecorded voice;
• Consent is not a condition of purchasing any property, goods, or services;

(d) Telephone number -- The agreement must include the specific telephone number to which the signatory authorizes calls to be delivered;

(e) Identification of the authorized seller -- The consent should specifically identify the Customer as the entity authorized to make calls. While multi-seller consent forms are currently legally permissible following the Eleventh Circuit's vacatur of the FCC's one-to-one consent rule (see Section 4.6), Talkif strongly recommends one-to-one consent as best practice for maximum litigation defense.

5.3 Additional Requirements for AI Calls. Given that the Platform uses AI-generated voice, Customer should additionally disclose in the consent form that calls will be made using artificial intelligence technology and that the Called Party will be interacting with an AI system, not a live human agent. While this is not explicitly required by current FCC rules, it reduces litigation risk and may be required under state consumer protection statutes or the FCC's future AI-specific rulemaking.

5.4 Record Retention. Customer must retain PEWC records for a minimum of five (5) years from the date consent was obtained or five (5) years from the date of the last call made in reliance on that consent, whichever is later. Records must include: the complete consent form text as presented to the signer, the signature, timestamp, IP address (for electronic consent), the telephone number authorized, and the identity of the seller authorized.

5.5 Burden of Proof. In any TCPA proceeding, the burden of proving valid consent rests with the caller (Customer). Customer must be able to produce consent records on demand. Inability to produce records creates a rebuttable presumption of non-consent.

5.6 See Appendix B for a sample PEWC form. This sample is provided as a starting point only and must be reviewed by Customer's legal counsel before use.

6. DO NOT CALL COMPLIANCE

6.1 National Do Not Call Registry. Under 47 C.F.R. Section 64.1200(c)(2), Customer must not initiate telemarketing calls to telephone numbers registered on the National DNC Registry maintained by the Federal Trade Commission, unless an applicable exemption applies (e.g., existing business relationship, prior express written consent).

6.2 Registry Access and Scrubbing. Customer is solely responsible for:

(a) Obtaining access to the National DNC Registry through the FTC at https://telemarketing.donotcall.gov;

(b) Scrubbing all contact lists and campaign contact lists against the National DNC Registry before initiating any telemarketing campaign through the Platform;

(c) Updating registry data at least every thirty-one (31) days, as required by FTC rules;

(d) Maintaining records of DNC registry access and scrubbing for a minimum of five (5) years.

6.3 Internal Do Not Call List. Under 47 C.F.R. Section 64.1200(d), Customer must maintain its own internal DNC list containing the telephone numbers of all persons who have requested not to be called by Customer. Customer must:

(a) Honor all DNC requests as soon as practicable, not to exceed ten (10) business days of receiving the request (updated per FCC rule effective April 11, 2025, amending 47 CFR § 64.1200(d)(3); previously 30 days);

(b) Record the date of each DNC request;

(c) Maintain internal DNC records for a minimum of five (5) years;

(d) Ensure that no call is placed to a number on the internal DNC list, regardless of any prior consent;

(e) Apply internal DNC suppression to all campaigns, schedules, and individual calls placed through the Platform.

6.4 Platform DNC Capabilities. The Platform provides built-in DNC list management with the following features: internal DNC list per account with automatic call suppression, DNC audit trail with timestamps and request source, bulk DNC import/export, and DNC status indicator on contact records. Customer remains responsible for scrubbing contact lists against the National DNC Registry before upload until registry integration is implemented.

6.5 DNC Request Processing During Calls. If a Called Party requests during a call to be placed on the DNC list, Customer must:

(a) Immediately note the request;

(b) Add the number to Customer's internal DNC list within ten (10) business days (immediate processing is strongly recommended);

(c) Ensure no further calls are placed to that number from any campaign, schedule, or manual call through the Platform;

(d) If the number appears in any active campaign, remove it from the campaign or mark it as skipped.

6.6 Exemptions from DNC Requirements. The following calls are exempt from National DNC Registry requirements (but NOT from internal DNC list requirements):

(a) Calls made with the Called Party's prior express written consent;

(b) Calls made within an established business relationship (within 18 months of the last transaction or 3 months of the last inquiry), provided the Called Party has not requested to be placed on Customer's internal DNC list;

(c) Calls made by or on behalf of a tax-exempt nonprofit organization.

Customer is solely responsible for determining and documenting the applicability of any exemption.

7. TIME OF DAY RESTRICTIONS

7.1 Federal Time Restrictions. Under 47 C.F.R. Section 64.1200(c)(1), no telemarketing call may be made to a residential telephone line before 8:00 AM or after 9:00 PM in the Called Party's local time zone. This restriction applies to the time at the recipient's location, NOT the caller's location.

7.2 Application to All Automated Calls. While the FCC rule technically applies to "telephone solicitations" to residential lines, the Platform places all calls using artificial voice, and prudent compliance practice dictates applying the 8:00 AM to 9:00 PM restriction to ALL calls placed through the Platform to U.S. numbers, regardless of whether the call is classified as telemarketing or informational. This is the approach recommended by this Addendum.

7.3 Platform Time Window Controls. The Platform provides the following technical controls to support time-of-day compliance:

(a) Campaign Time Windows -- Each campaign can be configured with earliest_call_time and latest_call_time parameters that restrict when calls may be placed;

(b) Contact Timezone Respect -- When respect_contact_timezone is enabled for a campaign, the Platform evaluates time windows against each Contact's local timezone rather than a single campaign timezone;

(c) Allowed Days of Week -- Campaigns can be configured with allowed_days (Monday=1 through Sunday=7) to restrict calling to specific days;

(d) Campaign Call Windows -- Multiple time windows can be configured per campaign, with optional per-day-of-week granularity.

7.4 Customer Configuration Responsibility. While the Platform provides time window controls, Customer is solely responsible for:

(a) Configuring campaign time windows to comply with the 8:00 AM to 9:00 PM restriction in EVERY time zone where Called Parties are located;

(b) Enabling respect_contact_timezone for all campaigns that call recipients in multiple time zones;

(c) Ensuring Contact records have accurate timezone information when respect_contact_timezone is enabled;

(d) Accounting for Daylight Saving Time transitions, which may temporarily shift the effective calling window;

(e) Complying with stricter state-level time restrictions where applicable (see Section 14).

7.5 Recommended Safe Harbor Configuration. To minimize compliance risk across all U.S. time zones, Talkif recommends the following campaign configuration as a safe harbor:

• earliest_call_time: 09:00 (provides one-hour buffer)
• latest_call_time: 20:00 (provides one-hour buffer)
• respect_contact_timezone: true
• allowed_days: [1, 2, 3, 4, 5] (weekdays only, unless Customer has confirmed weekend calling is permissible under applicable state law)

7.6 Platform Does Not Guarantee Compliance. The Platform's time window features are tools to assist compliance. They do NOT constitute a guarantee of compliance. Incorrect timezone data, misconfigured windows, system clock drift, and other factors may result in calls outside permitted hours. Customer remains responsible for verifying compliance.

8. CALLER IDENTIFICATION REQUIREMENTS

8.1 Federal Caller ID Requirements. Under 47 U.S.C. Section 227(e) (Truth in Caller ID Act) and 47 C.F.R. Section 64.1604, it is unlawful to transmit misleading or inaccurate caller identification information with the intent to defraud, cause harm, or wrongfully obtain anything of value.

8.2 Platform Caller ID Implementation. The Platform transmits caller identification as follows:

(a) Caller ID Number -- The from_phone_number configured in the call, schedule, or campaign is transmitted as the caller ID number. This number must be a valid, dialable telephone number controlled by Customer;

(b) Verified Caller IDs -- The Platform supports Twilio Verified Caller ID functionality, which requires the number owner to verify ownership before the number can be used for outbound calling;

(c) BYOC Trunk Caller ID -- For BYOC (Bring Your Own Carrier) configurations, the caller ID is determined by the SIP provider's configuration and Customer's trunk settings.

8.3 Customer Caller ID Obligations. Customer must ensure that:

(a) All calls placed through the Platform transmit an accurate caller ID number that is a working telephone number assigned to or controlled by Customer;

(b) The caller ID number is capable of receiving return calls (47 C.F.R. Section 64.1200(b)(1)) -- the Called Party must be able to call the number back;

(c) The caller ID name (CNAM) is accurate and identifies Customer or Customer's business;

(d) No caller ID spoofing is performed, whether through Platform configuration, SIP provider settings, or any other means;

(e) For BYOC Trunk configurations, Customer has verified that the SIP provider is transmitting correct caller ID information and is not overriding or altering the intended caller ID.

8.4 TRACED Act Compliance. The Pallone-Thune Telephone Robocall Abuse Criminal Enforcement and Deterrence Act (TRACED Act, Pub. L. 116-105) strengthened caller ID authentication requirements. Talkif's telephony infrastructure relies on Twilio and Customer's SIP providers for STIR/SHAKEN caller ID authentication (see Section 11). Customer is responsible for ensuring that their SIP provider (if using BYOC) participates in the STIR/SHAKEN framework.

8.5 Required Disclosures During Call. For all calls using prerecorded or artificial voice, 47 C.F.R. Section 64.1200(b)(2) requires that the call must:

(a) At the beginning of the message, clearly state the identity of the business, individual, or other entity initiating the call;

(b) During or after the message, provide the telephone number or address of the caller. The number provided must be a working number that is not a 900 number or any other number for which charges exceed local or long-distance transmission charges.

8.6 Customer is responsible for configuring the Platform's AI conversation flows to include these required disclosures at the beginning of every call.

9. ARTIFICIAL AND PRERECORDED VOICE RULES

9.1 AI-Generated Voice is Artificial/Prerecorded Voice. On February 8, 2024, the FCC issued a Declaratory Ruling (FCC 24-17) confirming that calls made with AI-generated voice technology are subject to the TCPA's restrictions on artificial and prerecorded voice calls. This ruling applies to all calls placed through the Platform's AI voice features.

9.2 Consent Requirements for Artificial Voice Calls. Under 47 U.S.C. Section 227(b)(1):

(a) Calls to Residential Lines -- It is unlawful to initiate any telephone call to any residential telephone line using an artificial or prerecorded voice to deliver a message without the prior express consent of the called party, unless the call is made for emergency purposes or falls within a specific FCC exemption;

(b) Calls to Wireless/Cell Lines -- It is unlawful to make any call using an artificial or prerecorded voice or text message to any telephone number assigned to a paging service, cellular telephone service, specialized mobile radio service, or other radio common carrier service, or any service for which the called party is charged for the call, without prior express consent of the called party.

9.3 Opt-Out Mechanism Requirement. Under 47 C.F.R. Section 64.1200(b)(3), all prerecorded or artificial voice telemarketing calls must include an automated, interactive opt-out mechanism that:

(a) Is available throughout the duration of the call;

(b) Allows the Called Party to opt out by pressing a key during the call;

(c) Automatically adds the Called Party's number to Customer's internal DNC list;

(d) Is announced at the beginning of the prerecorded message.

For non-telemarketing calls using artificial voice, an opt-out mechanism is strongly recommended even if not strictly required by current FCC rules.

9.4 Customer AI Flow Configuration. Customer must configure the Platform's AI conversation flows to:

(a) Identify Customer's business name at the beginning of the call;

(b) Provide an opt-out mechanism (e.g., "Press [key] or say 'stop' to be removed from our calling list");

(c) Comply with any applicable state-specific AI disclosure requirements (see Section 14);

(d) Provide a callback number at which the caller (Customer) can be reached.

9.5 FCC Exemptions. The FCC has established limited exemptions from the prerecorded voice consent requirement for:

(a) Emergency calls (including health care messages with certain conditions);

(b) Calls not made for a commercial purpose;

(c) Calls made for a commercial purpose that do not include or introduce an unsolicited advertisement or constitute a telephone solicitation;

(d) Calls by or on behalf of a tax-exempt nonprofit organization;

(e) Calls delivering health care-related messages made by covered entities or their business associates under HIPAA (subject to specific FCC conditions).

Customer is solely responsible for determining and documenting the applicability of any exemption.

10. CALL RECORDING COMPLIANCE

10.1 Platform Recording Capability. The Platform supports call recording through its telephony integration (Twilio). Call recordings are stored with call records and are accessible through the Platform.

10.2 Federal Wiretap Law. Under federal law (18 U.S.C. Section 2511), recording a telephone call requires the consent of at least ONE party to the call ("one-party consent"). Because Customer or Customer's AI agent is a party to the call, federal one-party consent is generally satisfied for calls recorded by Customer.

10.3 State Two-Party (All-Party) Consent Laws. Approximately thirteen (13) U.S. states require the consent of ALL parties to a telephone call before it may be recorded. These states include, but may not be limited to: California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Pennsylvania, and Washington. State laws change; Customer must verify current requirements.

Note on Delaware: Delaware has conflicting statutes. Del. Code tit. 11, § 2402(c)(4) allows one-party consent for wiretapping, but a separate privacy statute (§ 1335(a)(4)) prohibits interception without all-party consent. Most practitioners advise treating Delaware as an all-party consent state for telephone calls.

10.4 Customer Recording Obligations. If Customer uses the Platform's recording functionality, Customer must:

(a) Determine whether the Called Party is located in a one-party or all-party consent state;

(b) For all-party consent states, provide clear notice of recording at the beginning of the call AND obtain affirmative consent before continuing the recorded call;

(c) Configure AI conversation flows to include recording disclosure where required;

(d) Maintain records of recording consent;

(e) Comply with applicable data retention and destruction requirements for recordings.

10.5 Recommended Practice. Given the difficulty of determining a Called Party's location in advance (wireless numbers are not geographically fixed), Talkif strongly recommends that Customer provide recording notice and obtain consent for ALL calls where recording is enabled, regardless of the Called Party's presumed location. This "all-party consent everywhere" approach eliminates the risk of state law violations.

11. ROBOCALL MITIGATION AND STIR/SHAKEN

11.1 STIR/SHAKEN Framework. The TRACED Act requires voice service providers to implement the STIR/SHAKEN caller ID authentication framework to combat illegal robocalling and caller ID spoofing. STIR/SHAKEN provides three attestation levels:

(a) Full Attestation (A) -- The provider has verified the caller's identity AND that the caller is authorized to use the calling number;

(b) Partial Attestation (B) -- The provider has verified the caller's identity but cannot verify that the caller is authorized to use the number;

(c) Gateway Attestation (C) -- The provider has authenticated the source of the call but cannot verify the caller's identity or the number.

11.2 Platform STIR/SHAKEN Implementation. STIR/SHAKEN signing is handled at the carrier level:

(a) Talkif-Provisioned Numbers -- Twilio signs calls with appropriate attestation based on the number's ownership verification. Numbers purchased through the Platform typically receive Full (A) attestation;

(b) BYOC Trunk -- Attestation depends on Customer's SIP provider and their STIR/SHAKEN implementation. Customer is responsible for ensuring their SIP provider participates in STIR/SHAKEN and provides appropriate attestation levels;

(c) Verified Caller IDs -- Numbers verified through Twilio's Verified Caller ID process may receive higher attestation levels.

11.3 Customer Responsibility. Customer must:

(a) Use legitimate, verified telephone numbers for outbound calling;

(b) Ensure reasonable call volumes that do not trigger carrier-level robocall blocking;

(c) Monitor call completion rates for indications that calls are being blocked or filtered;

(d) Respond promptly to any traceback requests received through Talkif or Customer's SIP provider.

11.4 Platform Rate Limiting. The Platform enforces per-account rate limits (calls per minute) and concurrent call limits to mitigate robocalling risk. These limits are:

(a) Concurrent call limit -- Configurable per account tier (default: 10 concurrent calls);

(b) Calls per minute -- Sliding window rate limit (default: 60 calls per minute);

(c) Burst limit -- Short-window maximum to prevent burst dialing;

(d) System-wide limits -- Global maximum concurrent calls and queue depth.

These limits serve dual purposes: platform stability and robocall mitigation.

12. RECORD KEEPING REQUIREMENTS

12.1 Customer Record Keeping Obligations. Under 47 C.F.R. Section 64.1200(d), Customer must maintain the following records for a minimum of five (5) years:

(a) Consent Records -- Complete records of all consent obtained, including:

• The full text of the consent disclosure as presented to the consenting party
• The consenting party's signature (or electronic equivalent)
• The telephone number for which consent was provided
• The date and time consent was obtained
• The method by which consent was obtained (web form, paper, verbal, etc.)
• For electronic consent: IP address, device information, session data
• For verbal consent: recording of the consent exchange
• Any subsequent modifications or revocations of consent

(b) Do Not Call Records -- Records of all DNC requests received, including:

• The telephone number requesting DNC status
• The date the request was received
• The source of the request (during call, email, letter, etc.)
• The date the request was processed
• Proof that subsequent calls to that number were suppressed

(c) DNC Registry Access Records -- Records of:

• Dates on which Customer accessed and downloaded the National DNC Registry
• Subscription and account information for Registry access
• Records of contact list scrubbing against the Registry

(d) Written DNC Policy -- A written policy setting forth Customer's procedures for maintaining its internal DNC list, which must be available upon demand.

12.2 Platform Record Retention. Talkif retains the following records on the Platform:

(a) Call Records -- Retained for the duration of the account, then deleted in accordance with the Data Processing Agreement. Includes: call direction, from/to numbers, timestamps, duration, status, cost, recording URL, and metadata;

(b) Campaign Records -- All campaign configurations, contact lists, and per-contact status (pending, queued, calling, completed, failed, no_answer);

(c) Schedule Records -- All schedule configurations and execution history;

(d) Billing Records -- Retained as required by applicable financial and tax regulations.

12.3 Platform Records Are Not Consent Records. The Platform's call and campaign records document that calls were placed. They do NOT constitute evidence of consent. Customer is solely responsible for maintaining consent records outside the Platform (or through Customer's own systems).

12.4 Litigation Hold. In the event of any TCPA complaint, threatened litigation, or regulatory inquiry, Customer must immediately implement a litigation hold on all records related to the subject matter, including Platform data, consent records, DNC records, and all related communications.

13. CAMPAIGN-SPECIFIC REQUIREMENTS

13.1 Pre-Campaign Compliance Verification. Before launching any campaign through the Platform, Customer must verify:

(a) Consent Basis -- Every Contact in the campaign has provided the appropriate level of consent (PEC for informational calls, PEWC for telemarketing calls) for the specific purpose of the campaign;

(b) DNC Scrubbing -- The contact list has been scrubbed against both the National DNC Registry and Customer's internal DNC list within the past thirty-one (31) days;

(c) Contact List Source -- The contact list was lawfully obtained and the contacts have a legitimate relationship with Customer or have provided explicit consent to be contacted;

(d) Time Window Configuration -- Campaign time windows are configured to comply with federal and applicable state time-of-day restrictions (see Section 7);

(e) Caller ID -- The campaign's from_phone_number is a valid, dialable number controlled by Customer that can receive return calls;

(f) Flow Compliance -- The AI conversation flow includes required disclosures (caller identification, opt-out mechanism) as described in Sections 8 and 9;

(g) State Compliance -- Customer has reviewed and complied with state-specific requirements for all states where campaign Contacts are located (see Section 14).

13.2 Contact List Integrity. Customer warrants that:

(a) All telephone numbers in campaign contact lists were obtained directly from the Called Party or through a lawful and documented chain of consent;

(b) Contact lists do NOT include numbers obtained from purchased lists, scraped data, harvested data, or any other source where individual consent has not been verified;

(c) Contact information is accurate and current to the best of Customer's knowledge;

(d) Contacts with unknown or unverified consent status are NOT included in any campaign.

13.3 Opt-Out Processing. When a Called Party requests to be removed from a campaign (whether during the call, through callback to the caller ID number, or through any other means):

(a) Customer must remove the Contact from the active campaign immediately, or as soon as technically feasible;

(b) The Contact's number must be added to Customer's internal DNC list;

(c) The Contact must NOT be added to any future campaign unless new, valid consent is obtained;

(d) Customer should remove opted-out contacts from active campaigns by removing them from the contact list or pausing the campaign.

13.4 Campaign Monitoring. During campaign execution, Customer must:

(a) Monitor completion rates, answer rates, and complaint rates;

(b) Immediately pause or stop a campaign if a pattern of complaints or DNC violations is detected;

(c) Investigate and respond to all consumer complaints within thirty (30) days;

(d) Report any suspected TCPA violations or compliance issues to Talkif promptly.

13.5 Campaign Documentation. For each campaign, Customer must maintain documentation of:

(a) The business purpose of the campaign;

(b) The legal basis for calling each Contact (consent type, exemption claimed);

(c) The date the contact list was last scrubbed against the National DNC Registry;

(d) The campaign configuration (time windows, days of week, caller ID);

(e) Campaign results (calls completed, opt-outs received, complaints received);

(f) Any compliance issues encountered and remediation actions taken.

14. STATE-LEVEL REQUIREMENTS

14.1 State Laws May Be Stricter Than Federal TCPA. Many U.S. states have enacted telemarketing statutes that impose requirements stricter than or in addition to the federal TCPA. The TCPA does not preempt state law where state law provides greater protection to consumers (47 U.S.C. Section 227(f)(1)). Customer must comply with the laws of every state where Called Parties are located.

14.2 Key State Requirements. The following is a non-exhaustive summary of selected states with notably stricter requirements. THIS IS NOT A COMPLETE LIST. Customer must research and comply with the laws of all applicable states.

14.2.1 Florida (Fla. Stat. Section 501.059)

• Written consent required for ALL unsolicited telephonic sales calls (amended 2023 to narrow scope to "unsolicited" calls)
• No calls before 8:00 AM or after 8:00 PM local time (one hour stricter than federal)
• Registration required with Florida Department of Agriculture and Consumer Services
• Statutory damages of $500 per violation, $1,500 for subsequent violations
• Private right of action

14.2.2 California (Cal. Civ. Code Section 1770 et seq.; Cal. Pub. Util. Code Section 2871 et seq.)

• Registration with California Attorney General's office
• Stricter time restrictions may apply under unfair competition law (Cal. Bus. & Prof. Code Section 17200)
• Private right of action under Consumer Legal Remedies Act
• Two-party consent for call recording (Cal. Penal Code Section 632)

14.2.3 Illinois (815 ILCS 305/)

• Registration with Illinois Attorney General
• Caller must immediately identify themselves and the product/service
• Must provide toll-free number for opt-out

14.2.4 Washington (RCW 19.158)

• Registration with Washington Secretary of State
• No calls to numbers on Washington State DNC list
• No calls before 8:00 AM or after 8:00 PM local time

14.2.5 New York (N.Y. Gen. Bus. Law Section 399-z)

• Registration with New York Department of State
• Written confirmation of DNC requests
• Additional disclosure requirements

14.2.6 Texas (Tex. Bus. & Com. Code Section 302 et seq.)

• Registration with Texas Secretary of State
• No calls before 9:00 AM or after 9:00 PM local time (Monday through Saturday)
• Sunday restriction: No calls before 12:00 PM (noon) or after 9:00 PM local time on Sundays
• Must disconnect within 25 seconds if no answer

14.2.7 Georgia (Ga. Code Section 46-5-27)

• Registration with Georgia Governor's Office of Consumer Protection
• No calls to Georgia DNC list numbers

14.3 State Registration Requirements. Many states require telemarketers to register and/or obtain a license before making telemarketing calls to residents of that state. Customer is solely responsible for obtaining all required state registrations and licenses.

14.4 State DNC Lists. In addition to the National DNC Registry, several states maintain their own DNC lists. Customer must scrub contact lists against applicable state DNC lists before initiating campaigns targeting residents of those states.

14.5 See Appendix D for a summary table of state-specific requirements. Appendix D is provided for reference only and may not be current. Customer must independently verify all state requirements.

15. CUSTOMER OBLIGATIONS

15.1 Comprehensive Obligation. Customer acknowledges and agrees that Customer bears full and sole responsibility for TCPA compliance in connection with Customer's use of the Platform. Without limiting the generality of the foregoing, Customer specifically agrees to:

15.2 Consent Management. (a) Obtain all required consent (PEC or PEWC as applicable) from every Called Party before placing any call through the Platform; (b) Maintain complete, auditable records of all consent obtained; (c) Implement systems to track consent revocation and ensure revocations are honored immediately; (d) Not rely on consent obtained by third parties unless that consent specifically names Customer as the authorized caller; (e) Verify that consent has not expired, been revoked, or become invalid before each call.

15.3 Do Not Call Compliance. (a) Maintain an internal DNC list and scrub against it before every call; (b) Access and scrub against the National DNC Registry at least every thirty-one (31) days; (c) Process DNC requests within ten (10) business days of receipt (immediate processing recommended); (d) Maintain DNC records for a minimum of five (5) years; (e) Have a written DNC policy available on demand.

15.4 Caller ID and Disclosure. (a) Configure accurate, non-misleading caller ID for all calls; (b) Use only telephone numbers controlled by Customer that can receive return calls; (c) Configure AI conversation flows to identify Customer at the beginning of each call; (d) Provide opt-out mechanism for telemarketing calls; (e) Include callback number in all calls.

15.5 Time of Day Compliance. (a) Configure campaign time windows to comply with federal and all applicable state time restrictions; (b) Enable respect_contact_timezone for campaigns targeting multiple time zones; (c) Ensure Contact timezone data is accurate; (d) Apply the stricter of federal or applicable state restrictions.

15.6 AI Disclosure. (a) Where required by applicable law, disclose to the Called Party that the call is being made using artificial intelligence; (b) Configure AI flows to respond truthfully if the Called Party asks whether they are speaking with a human or AI; (c) Monitor evolving AI disclosure requirements at both federal and state levels.

15.7 Campaign Management. (a) Verify consent basis for every Contact in every campaign before launch; (b) Scrub contact lists against DNC registries before launch; (c) Monitor campaigns for complaints and opt-outs; (d) Pause or stop campaigns immediately upon detecting compliance issues; (e) Maintain complete campaign documentation as described in Section 13.5.

15.8 State Compliance. (a) Identify all states where Called Parties are located; (b) Comply with each applicable state's telemarketing laws; (c) Obtain required state registrations and licenses; (d) Scrub against applicable state DNC lists.

15.9 Complaint Handling. (a) Establish a process for receiving and responding to consumer complaints; (b) Respond to all complaints within thirty (30) days; (c) Maintain complaint records for a minimum of five (5) years; (d) Report patterns of complaints to Talkif.

15.10 Cooperation with Investigations. (a) Cooperate with any regulatory investigation related to calls placed through the Platform; (b) Preserve all relevant records upon notice of any investigation or legal proceeding; (c) Provide Talkif with prompt notice of any TCPA-related complaint, investigation, or legal proceeding.

16. TALKIF'S ROLE AND RESPONSIBILITIES

16.1 Platform Provider. Talkif is a technology platform provider. Talkif does not determine the content, timing, recipients, or purpose of calls placed by Customers through the Platform. Talkif is not the "caller" or "initiator" under TCPA for calls placed by Customers.

16.2 Technical Compliance Tools. Talkif provides the following technical controls to support Customer's compliance efforts:

(a) Campaign Time Windows -- Configurable earliest_call_time and latest_call_time per campaign;

(b) Timezone Respect -- respect_contact_timezone flag for per-contact timezone evaluation;

(c) Day-of-Week Restrictions -- allowed_days configuration for campaigns;

(d) Rate Limiting -- Per-account calls-per-minute and concurrent call limits;

(e) Caller ID Verification -- Integration with Twilio's Verified Caller ID;

(f) Call Records -- Retention of call metadata for audit purposes;

(g) Campaign Controls -- Ability to pause, resume, and stop campaigns;

(h) Contact Status Tracking -- Per-contact campaign status (pending, queued, calling, completed, failed, no_answer).

16.3 Talkif Does NOT:

(a) Verify that Customer has obtained consent from Called Parties;

(b) Check contact lists against the National DNC Registry or any state DNC list;

(c) Maintain DNC lists on behalf of Customer;

(d) Validate that AI conversation flows contain required disclosures;

(e) Determine whether Customer's calls constitute telemarketing or informational calls;

(f) Monitor call content for compliance with disclosure requirements;

(g) Guarantee that time window configurations will prevent all calls outside permitted hours;

(h) Verify the accuracy of Contact timezone data;

(i) Verify that Customer has obtained required state registrations or licenses.

16.4 Talkif's Compliance Monitoring Rights. Talkif reserves the right, but has no obligation, to:

(a) Monitor call volumes, patterns, and complaint rates for indications of non-compliance;

(b) Request documentation of Customer's consent records, DNC procedures, and compliance programs;

(c) Suspend or terminate Customer's access to the Platform upon reasonable suspicion of TCPA violations (see Section 21);

(d) Cooperate with regulatory authorities and law enforcement in connection with TCPA enforcement actions;

(e) Implement platform-level restrictions on calling hours, call volumes, or campaign sizes in response to identified compliance risks.

16.5 Talkif's Cooperation with Law Enforcement. Talkif will cooperate with the FCC, FTC, state attorneys general, and other law enforcement agencies in connection with TCPA investigations. This cooperation may include providing call records, account information, and other data related to Customer's use of the Platform, consistent with applicable law and Talkif's Privacy Policy.

17. COMPLIANCE MONITORING AND ENFORCEMENT

17.1 Customer Compliance Program. Customer must implement and maintain a TCPA compliance program that includes, at minimum:

(a) A designated compliance officer or team responsible for TCPA compliance;

(b) Written TCPA compliance policies and procedures;

(c) Regular training for personnel involved in campaign management;

(d) Internal audit procedures to verify compliance;

(e) A complaint handling and escalation process;

(f) Regular review and updating of compliance procedures.

17.2 Talkif's Compliance Signals. Talkif may monitor the following signals for potential compliance issues:

(a) Unusually high call volumes relative to account size;

(b) High complaint rates received through carrier channels;

(c) Abnormally low answer rates (may indicate calls to invalid/recycled numbers);

(d) Calls placed outside of normal business hours;

(e) Requests from carriers or regulators regarding specific accounts;

(f) Reports from Called Parties received by Talkif.

17.3 Compliance Inquiry. If Talkif identifies potential compliance concerns, Talkif may issue a Compliance Inquiry requiring Customer to provide, within five (5) business days:

(a) Documentation of consent for a sample of Called Parties;

(b) Evidence of DNC list scrubbing for the relevant campaign;

(c) Description of Customer's TCPA compliance program;

(d) Any other information reasonably related to the compliance concern.

17.4 Failure to respond to a Compliance Inquiry, or provision of inadequate or non-credible responses, may result in suspension or termination under Section 21.

18. PENALTIES AND LIABILITY ALLOCATION

18.1 Federal TCPA Penalties.

(a) Private Right of Action -- Any person or entity may bring an action in federal or state court for violation of the TCPA (47 U.S.C. Section 227(b)(3), (c)(5));

(b) Statutory Damages -- $500 per violation;

(c) Treble Damages -- Up to $1,500 per violation for willful or knowing violations;

(d) No Cap on Aggregate Damages -- There is no statutory maximum on total damages. In class action litigation, damages are calculated per violation (per call);

(e) FCC Enforcement -- The FCC may impose forfeiture penalties under 47 U.S.C. Section 503, with inflation-adjusted maximums exceeding $20,000 per violation. Additionally, the TRACED Act (Pub. L. 116-105) authorizes the FCC to impose an additional forfeiture of up to $10,000 per intentional violation (on top of base forfeitures), with a 4-year statute of limitations for intentional violations (up from 1 year);

(f) State Attorney General Actions -- State attorneys general may bring actions on behalf of state residents.

18.2 Illustrative Damage Calculations.

18.3 Liability Allocation. Customer acknowledges and agrees that:

(a) Customer is the "caller" under TCPA and bears primary liability for all TCPA violations arising from Customer's use of the Platform;

(b) Talkif is a platform provider and does not control the content, timing, or recipients of Customer's calls;

(c) Customer's indemnification obligations under Section 19 are a material term of this Addendum and the Agreement;

(d) Talkif's provision of compliance tools does not shift TCPA liability to Talkif.

19. INDEMNIFICATION

19.1 Customer Indemnification. Customer shall indemnify, defend, and hold harmless Talkif, its officers, directors, employees, agents, affiliates, successors, and assigns (collectively, "Talkif Indemnified Parties") from and against any and all claims, demands, actions, suits, proceedings, losses, damages, liabilities, costs, and expenses (including reasonable attorneys' fees and court costs) arising out of or relating to:

(a) Any actual or alleged violation of the TCPA, FCC rules, state telemarketing laws, or any other applicable law, arising from Customer's use of the Platform;

(b) Any call placed by Customer through the Platform for which Customer did not have valid, documented consent;

(c) Any call placed to a telephone number on the National DNC Registry or any state DNC list, where Customer failed to scrub the number;

(d) Any call placed outside of permitted calling hours;

(e) Any caller ID spoofing or misrepresentation by Customer;

(f) Any failure by Customer to comply with the obligations set forth in this Addendum;

(g) Any class action, consolidated action, or multi-district litigation arising from Customer's calling practices;

(h) Any regulatory investigation, enforcement action, or proceeding by the FCC, FTC, state attorney general, or any other governmental authority arising from Customer's calling practices.

19.2 Indemnification Procedure.

(a) Talkif shall provide Customer with prompt written notice of any claim for which indemnification is sought;

(b) Customer shall have the right to control the defense of any such claim, provided that Customer may not settle any claim in a manner that imposes liability or obligations on Talkif without Talkif's prior written consent;

(c) Talkif shall cooperate with Customer in the defense of any claim, at Customer's expense;

(d) If Customer fails to assume the defense of any claim within thirty (30) days of notice, Talkif may assume the defense at Customer's expense.

19.3 Survival. Customer's indemnification obligations under this Section shall survive the termination or expiration of the Agreement for a period of six (6) years, reflecting the applicable statute of limitations for TCPA claims (four years under 28 U.S.C. Section 1658 for federal claims, with state claims potentially having longer limitations periods).

20. REPRESENTATIONS AND WARRANTIES

20.1 Customer Represents and Warrants That:

(a) Customer has read and understood this Addendum in its entirety;

(b) Customer has consulted with or had the opportunity to consult with independent legal counsel regarding TCPA compliance obligations;

(c) Customer has implemented or will implement a TCPA compliance program sufficient to meet all obligations described in this Addendum before placing any calls through the Platform;

(d) Customer will obtain all required consent before placing any call through the Platform;

(e) Customer will maintain all required records for the periods specified in this Addendum;

(f) Customer will comply with all applicable federal, state, and local laws governing telephone calls, telemarketing, and automated calling;

(g) All contact lists used in the Platform are lawfully obtained and have been scrubbed against applicable DNC registries;

(h) Customer has obtained or will obtain all required state registrations and licenses before making telemarketing calls to residents of those states;

(i) Customer will promptly notify Talkif of any TCPA-related complaint, investigation, or legal proceeding;

(j) The information provided to Talkif in connection with this Addendum is accurate and complete.

20.2 Talkif Represents and Warrants That:

(a) Talkif will maintain the Platform in reasonable working order;

(b) The technical compliance controls described in Section 16.2 will function substantially as described;

(c) Talkif will maintain call records as described in Section 12.2;

(d) Talkif will cooperate with Customer in responding to regulatory inquiries to the extent required by law.

20.3 Disclaimer. EXCEPT AS EXPRESSLY SET FORTH IN THIS ADDENDUM, TALKIF MAKES NO WARRANTIES REGARDING TCPA COMPLIANCE AND EXPRESSLY DISCLAIMS ANY WARRANTY THAT THE PLATFORM'S FEATURES WILL ENSURE CUSTOMER'S COMPLIANCE WITH THE TCPA OR ANY OTHER LAW. COMPLIANCE IS AND REMAINS CUSTOMER'S SOLE RESPONSIBILITY.

21. SUSPENSION AND TERMINATION FOR NON-COMPLIANCE

21.1 Immediate Suspension. Talkif may immediately suspend Customer's access to all or part of the Platform, including but not limited to campaign functionality, scheduling, and outbound calling, without prior notice, if:

(a) Talkif receives a complaint, legal demand, or regulatory inquiry relating to Customer's TCPA compliance;

(b) Talkif reasonably believes that Customer's calling practices pose a material risk of TCPA liability to Talkif;

(c) Customer fails to respond to a Compliance Inquiry within the timeframe specified in Section 17.3;

(d) Customer's response to a Compliance Inquiry reveals inadequate consent documentation or DNC procedures;

(e) A carrier or regulatory body requests suspension of Customer's calling capabilities;

(f) Customer's account exhibits patterns consistent with non-compliant calling (e.g., unusually high complaint rates).

21.2 Termination for Non-Compliance. Talkif may terminate the Agreement and Customer's access to the Platform if:

(a) Customer fails to cure a compliance deficiency within thirty (30) days of written notice;

(b) Customer is found to have willfully violated the TCPA or this Addendum;

(c) Customer makes materially false representations regarding consent, DNC compliance, or any other TCPA obligation;

(d) Customer's calling practices result in a regulatory enforcement action naming Talkif.

21.3 Effect of Suspension or Termination. Suspension or termination under this Section:

(a) Does not relieve Customer of any obligations under this Addendum, including indemnification;

(b) Does not entitle Customer to any refund of prepaid fees;

(c) Does not limit Talkif's right to pursue other remedies available at law or in equity;

(d) Shall trigger immediate cessation of all active campaigns, schedules, and pending calls.

22. AMENDMENTS AND REGULATORY CHANGES

22.1 Regulatory Updates. The TCPA and related regulations are subject to change through FCC rulemaking, court decisions, and legislative action. Talkif may update this Addendum from time to time to reflect changes in applicable law. Material changes will be communicated to Customer via email or Platform notification at least thirty (30) days before taking effect, except where immediate changes are required by law or regulatory action.

22.2 Customer's Obligation to Monitor. Notwithstanding Section 22.1, Customer is independently responsible for monitoring changes to TCPA and applicable state laws and for adjusting Customer's compliance program accordingly, regardless of whether this Addendum has been updated.

22.3 Continued Use. Customer's continued use of the Platform after the effective date of any amendment to this Addendum constitutes acceptance of the amended terms.

23. GOVERNING LAW AND DISPUTE RESOLUTION

23.1 Governing Law. This Addendum shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to its conflict of laws principles, except that TCPA claims shall be governed by federal law (47 U.S.C. Section 227 et seq.) and applicable state telemarketing laws as determined by the Called Party's location.

23.2 Dispute Resolution. Any dispute arising out of or relating to this Addendum shall be resolved in accordance with the dispute resolution provisions of the Agreement.

23.3 Severability. If any provision of this Addendum is held to be invalid, illegal, or unenforceable, the remaining provisions shall continue in full force and effect.

23.4 Entire Agreement. This Addendum, together with the Agreement, constitutes the entire agreement between the parties regarding TCPA compliance matters and supersedes all prior or contemporaneous agreements, representations, and understandings regarding such matters.

APPENDIX A: TCPA COMPLIANCE CHECKLIST

Customer must complete ALL items in this checklist before placing any calls through the Platform. This checklist should be reviewed and re-verified on a quarterly basis at minimum.

A.1 Pre-Launch Requirements

• Legal counsel retained -- Customer has consulted with an attorney knowledgeable in TCPA law
• Compliance officer designated -- A named individual is responsible for TCPA compliance
• Written TCPA policy created -- Internal policy document covering consent, DNC, time restrictions, disclosures
• Staff training completed -- All personnel involved in campaign management are trained on TCPA obligations
• Consent forms reviewed -- Consent forms reviewed by legal counsel and include all PEWC elements (Section 5.2)
• DNC policy written -- Written policy for maintaining and honoring DNC requests

A.2 Consent Documentation

• Consent type determined -- For each use case, identified whether PEC or PEWC is required
• Consent forms deployed -- Active consent collection mechanism in place
• Consent records stored -- System for storing and retrieving consent records
• Consent revocation process -- System for processing consent revocations immediately
• Consent retention -- Records retained for minimum 5 years
• Caller-specific consent (recommended) -- Consent specifically names Customer as authorized caller. While multi-seller consent is currently permissible (one-to-one rule vacated), one-to-one consent remains the strongest litigation defense

A.3 Do Not Call Compliance

• National DNC Registry access -- Active subscription to FTC DNC Registry
• Internal DNC list created -- System for maintaining internal DNC list
• DNC scrubbing process -- Documented process for scrubbing contact lists before campaigns
• DNC scrubbing frequency -- Registry data refreshed at least every 31 days
• DNC request processing -- Process for honoring DNC requests within 10 business days
• DNC records retained -- DNC records maintained for minimum 5 years
• State DNC lists checked -- Contact lists scrubbed against applicable state DNC lists

A.4 Platform Configuration

• Caller ID configured -- Valid, dialable number that can receive return calls
• CNAM set -- Caller ID name accurately identifies Customer
• Campaign time windows set -- earliest_call_time and latest_call_time comply with 8 AM - 9 PM (or stricter)
• Contact timezone enabled -- respect_contact_timezone = true for multi-timezone campaigns
• Allowed days configured -- allowed_days set appropriately for Customer's use case
• Rate limits reviewed -- Per-account rate limits are appropriate for Customer's volume
• AI flow includes disclosures -- Business identification at call beginning, opt-out mechanism, callback number

A.5 Campaign Launch

• Contact list source documented -- Source and legality of contact list documented
• Consent verified for all contacts -- Every contact has documented consent at the required level
• DNC scrub completed -- Contact list scrubbed within the last 31 days
• Time windows verified -- Calling hours comply with federal and applicable state law
• AI flow tested -- AI conversation flow tested for required disclosures
• Complaint handling ready -- Process in place for receiving and responding to complaints
• Monitoring plan -- Plan for monitoring campaign performance and compliance metrics

A.6 Ongoing Compliance

• Monthly DNC refresh -- National DNC Registry data refreshed every 31 days
• Quarterly compliance audit -- Internal review of TCPA compliance program
• Complaint tracking -- All complaints logged, investigated, and responded to within 30 days
• Consent record audit -- Periodic verification that consent records are complete and accessible
• State law monitoring -- Monitoring for changes to state telemarketing laws
• FCC order monitoring -- Monitoring for new FCC rules and declaratory rulings
• Training updates -- Staff training refreshed annually or upon material regulatory changes
• Record retention -- Verification that all records are retained for required periods

A.7 State-Specific Requirements

• State registrations obtained -- Required telemarketing registrations in all applicable states
• State DNC lists obtained -- Access to state DNC lists where applicable
• State time restrictions applied -- Stricter state time windows configured where applicable
• State-specific consent requirements met -- Additional consent requirements (e.g., Florida written consent for all automated calls) addressed
• Call recording consent -- Two-party consent states identified and recording disclosures configured

APPENDIX B: SAMPLE PRIOR EXPRESS WRITTEN CONSENT FORM

DISCLAIMER: This sample form is provided for illustration purposes ONLY. Customer MUST have this form reviewed and approved by qualified legal counsel before use. Talkif makes no warranty that this form satisfies TCPA requirements as applied to Customer's specific use case, industry, or jurisdiction. Requirements may change; Customer is responsible for ensuring forms comply with current law.

CONSENT TO RECEIVE AUTOMATED TELEPHONE CALLS

Company Name: [Customer's Legal Business Name]

Date: _______________

By signing below, I hereby provide my prior express written consent to [Customer's Legal Business Name] ("Company") to contact me at the telephone number provided below using automated telephone dialing systems, artificial intelligence-generated voice technology, and/or prerecorded voice messages for the following purposes:

Purpose of Calls: [Check all that apply]

• Appointment reminders and scheduling
• Account notifications and updates
• [Specific telemarketing purpose -- MUST be described specifically]
• [Additional specific purposes]

Telephone Number Authorized: (____) -__

I understand and acknowledge that:

1. I am authorizing [Customer's Legal Business Name] specifically to make these calls. This authorization does not extend to any other company or entity.

2. Calls will be made using automated dialing technology and artificial intelligence-generated voice (not a live human agent).

3. I may receive calls at the telephone number provided above related to the purposes identified above.

4. My consent is NOT a condition of purchasing any property, goods, or services from Company. I am not required to provide this consent to make a purchase or receive services.

5. I may revoke this consent at any time by:

   • Saying "stop" or "remove me" during any call
   • Calling Company at [Customer's Callback Number]
   • Emailing Company at [Customer's Email]
   • Writing to Company at [Customer's Mailing Address]

6. Message and data rates may apply. Standard carrier charges may apply to calls received.

7. I am the subscriber or customary user of the telephone number provided above.

Signature: ___________________________

Printed Name: ___________________________

Date: ___________________________

[For electronic consent: Include IP address capture, timestamp, session ID, and browser/device information in backend records]

APPENDIX C: PLATFORM TECHNICAL CONTROLS REFERENCE

The following Platform features support TCPA compliance. These are tools; they do not guarantee compliance.

Features NOT Currently Available (Customer Must Handle Externally)

APPENDIX D: STATE-SPECIFIC REQUIREMENTS SUMMARY

DISCLAIMER: This appendix is provided for general reference only. It is NOT a substitute for independent legal research. State laws change frequently. Customer is solely responsible for verifying current requirements. This table may not be complete or current.

Notes on This Table

1. "Registration Required" refers to state telemarketing registration or license requirements. Requirements may vary by call type (telemarketing vs. informational).

2. "State DNC List" indicates whether the state maintains its own Do Not Call list separate from the National DNC Registry.

3. "Time Restrictions" indicates the calling window. "Federal" means the state follows the federal 8:00 AM to 9:00 PM standard.

4. Recording consent requirements listed are for telephone conversations specifically. Some states have nuances (business vs. personal calls, expectation of privacy, etc.).

5. This table does NOT cover all state requirements. Many states have additional requirements regarding specific disclosures, bond requirements, cooling-off periods, and prohibited practices.