Service-specific terms

Some meruma features rely on third-party services with rules of their own. These terms are in addition to the terms of service and apply only to organizations using the corresponding feature.

WhatsApp and the Meta channels

By connecting WhatsApp, Instagram or Messenger, your organization also accepts the Meta terms that apply to its account, among them the WhatsApp Business Terms and the WhatsApp Messaging Policy.

• Your organization is the controller of its contacts’ data on those channels; meruma acts as processor and Meta as subprocessor.
• You may only write to someone who gave their number and their consent for that channel.
• Outside the 24-hour window from the person’s last message, WhatsApp only allows approved templates, and their category determines the price Meta charges.
• Conversations are billed by Meta directly to your business, not by us.
• Meta measures the quality of each number: blocks and reports can lead it to restrict or suspend sending, and that is out of our hands.
• Data we receive from Meta is kept separate per organization and is never shared between customers, as their terms require.
• Data from these channels is not used to train artificial intelligence models. That is a contractual prohibition from Meta which we honour and which your organization must honour too.
• Meta may require verification of your business before enabling certain features.

If Meta suspends or restricts your organization’s account, the channel stops working even though meruma is up.

SMS and calling

Calling and text messaging are provided through Telnyx.

• The service runs on credits your organization loads and consumes; it is not included in the plan price.
• Numbers are contracted in your organization’s name, and it answers for their use. Some countries require documentation from the holder before selling a number.
• meruma is not an emergency service. Calling runs over the internet: we do not guarantee reaching emergency numbers, transmitting your location, or working during a power or connectivity outage. Your organization must inform the people using the service of this limitation.
• Sending text messages to the United States requires registering the brand and campaign with the carrier registry. That registration requires, among other things, a public privacy policy belonging to your own organization with specific language about opt-in data: ours cannot stand in for it.
• Messages must let recipients reply STOP to opt out and HELP for assistance, and those replies must be handled.
• Call recording: if your organization turns it on, it is its responsibility to inform the other party and obtain consent where the law requires it. Recordings live in your organization and are deleted with it.

E-signature

meruma lets you send documents for signature and keep evidence of that signature.

• What is produced is an electronic signature: the signer expressly agrees to use electronic records and signatures before signing, and that consent is recorded with its exact wording.
• Every signed document carries an audit trail with the actions, their dates and times, and the IP address of whoever performed them, plus the hash of the original document to prove it was not altered.
• Every page carries a public identifier that allows verifying the document without access to the account.
• It is not a qualified digital signature with a certificate issued by a certification authority. In some jurisdictions and for certain acts — real estate, inheritance, some corporate acts — the law requires that qualified form or even a notarial deed. Your organization must check that an electronic signature is enough for the document it is about to sign.
• We keep documents and their trail for as long as the organization does; it is worth downloading and archiving important documents separately.

Artificial intelligence

meruma’s bots use third-party language models, today OpenAI.

• They run on your own organization’s key: usage is billed by the model provider directly.
• The conversation messages and the knowledge documents you upload are sent to the provider to generate each answer.
• Customer data is not used to train models, ours or the provider’s.
• The bot identifies itself as automated to the person it is talking to, from the first message. This is a legal requirement in the European Union and other jurisdictions, and it cannot be turned off.
• Answers are generated by a statistical model: they can be inaccurate or inappropriate. Your organization is responsible for what its bot says, for reviewing its configuration, and for handing over to a person when the case calls for it.
• Prohibited uses — employment decisions, credit assessment, inferring sensitive characteristics — are set out in the acceptable use policy.