Compliance
ClickedTools builds AI voice technology that calls people. That comes with a real regulatory surface: TCPA, state mini-TCPAs, two-party recording laws, FCC rules, state chatbot disclosure laws, Do-Not-Call registries. This page is the framework we run, and the framework your agency inherits the day you ship on top of our engine.
1. Shared responsibility
ClickedTools is responsible for the technical compliance layer: opt-in verification, DNC scrubbing, calling-window enforcement, AI disclosure delivery, recording, audit trail, opt-out enforcement, and retention. Your agency is responsible for what it tells us about each lead's consent (the source, the language the lead agreed to, and the timestamp) and for keeping that record intact in your AMS or lead source. If we do not have a clean opt-in on a lead, we do not call.
We will not disable the AI disclosure, the recording disclosure, the calling-window check, the DNC scrub, or the per-call audit trail. Those are non-negotiable regardless of the engagement.
2. Opt-in is mandatory
Every lead the AI calls must have affirmatively opted in to be contacted by phone, automated technology, AI voice, prerecorded messages, and SMS, naming your agency (or naming ClickedTools, on the demo we run from this site). We accept three sources of opt-in, and only these three:
Accepted opt-in sources
1. A form your agency owns, with an unchecked consent checkbox.
An unchecked consent checkbox sits next to or above the submit button. The checkbox label names your agency and lists automated calls, AI voice, prerecorded messages, and SMS as channels. The lead checks the box and submits the form; that affirmative act is the opt-in. Pre-checked boxes are not accepted and do not count. Your agency captures the form values, IP, user agent, page URL, timestamp, the checkbox state at submission, and snapshots of the consent label text. ClickedTools verifies the record is complete before any call is placed.
Accepted opt-in sources
2. A regulated lead vendor.
Vendors like Everquote and LendingTree capture TCPA-grade consent at the source and pass the consent record to us with the lead. We store the vendor consent record alongside the lead and reference it on every call.
Accepted opt-in sources
3. A prior opt-in on file.
If a lead previously opted in to your agency (and not opted out since), the original opt-in covers continued contact about the products that opt-in named. The original consent record stays linked to every call.
We will not dial:
- Cold lists.
- Third-party purchased lists without a verifiable lead-level consent record.
- Numbers on your agency's internal Do-Not-Call list.
- Numbers on the federal DNC registry where form-fill consent is not on file.
- Numbers that previously opted out of any ClickedTools or agency communication on any channel.
3. The consent record per lead
For every lead the AI is allowed to call, the system stores:
- The exact consent language as it was displayed to the lead, captured as both plain text and an HTML snapshot.
- The consent version identifier (so we can prove which version of the consent language was live at the moment of opt-in, even if the language has changed since).
- The form values the lead submitted, or the vendor record passed to us.
- The lead's IP address and user agent at the moment of submission (IP is captured server-side, since browsers cannot read their own IP).
- The submission timestamp in UTC plus the lead's timezone offset.
- The source: form on the agency's site, vendor name, or "prior opt-in".
- A stable consent record ID, referenced from every call placed to that lead.
Retention: minimum 4 years, up to 7 years, in line with TCPA defense windows.
4. Calling window enforcement
8:00 AM to 9:00 PM in the recipient's local time, every call, every market. We determine the recipient's timezone using a real-time number portability lookup on the phone number, not the area code, because area codes are unreliable for portable numbers. If a lead opts in at 10 PM Pacific, the call is queued for 8 AM Pacific the next morning. The window can be tightened further per state where law requires it; the engine reads the rules from configuration, not from a producer's memory.
5. DNC scrubbing
Every outbound call is preceded by three Do-Not-Call scrubs:
- Federal DNC. The number is checked against the U.S. FTC's National Do-Not-Call Registry. Form-fill consent typically overrides DNC registration, but we still scrub so we catch lead spam (someone submitting another person's number) and so we keep a defensible record.
- ClickedTools internal DNC. A permanent suppression list of every number that has ever opted out of any ClickedTools system, across phone, SMS, and email.
- Your agency's DNC. Synced from your AMS. If a number is on your DNC list, the AI does not dial.
If a number hits any of the three lists, the call is not placed. The most restrictive list wins.
6. AI disclosure on every call
Inside the first 15 seconds of every AI call, the agent delivers a standardized disclosure in this order: greeting plus agency identification, AI disclosure, reason tied to the lead's opt-in, recording disclosure, and permission to proceed. The single-line version sounds like this:
Standard AI opening
Hi [Name], this is Christian from [Agency]. I'm an AI assistant following up on the form you just filled out. This call is being recorded. Do you have a couple of minutes, or should I book a time?
That covers AI disclosure (required by several state chatbot laws, including California's BOT Act), agency identification (TCPA), the consent tie-back, the recording disclosure (required in two-party-consent states), and an immediate offer to end or reschedule the call. The script is customized to your agency's name and offer; the structure is fixed.
7. Saying stop, opt-out handling
The AI immediately respects: "stop calling," "don't call me," "remove me from your list," "take me off the list," "I'm not interested, don't call back," and reasonable variations. On hearing an opt-out, the AI does four things in order:
- Verbal confirmation: "Got it, I'll remove your number from our list. Have a good one."
- The call ends.
- The number is added to your agency's internal DNC list and to ClickedTools' internal DNC list within seconds.
- The number is prevented from receiving any further ClickedTools or agency-owned communication across phone, SMS, and email.
Opt-out events are also captured in the per-call log with a timestamp, so the response time is auditable.
8. Per-call audit trail
For every call the AI places, the system stores:
- Phone number dialed and time of dial in UTC.
- Recipient's local time at the moment of dial, proving the call landed inside the 8 AM to 9 PM local window.
- Result of the DNC scrub (federal, ClickedTools internal, agency).
- Linked consent record ID (the opt-in record that authorized this call).
- Call outcome: connected, voicemail, no answer, opt-out, scheduled.
- Full audio recording and transcript of the call.
- AI disclosure flag, derived from the transcript, confirming the disclosure script was delivered.
- Any opt-out event detected, with the timestamp at which the AI took the number out of rotation.
Recordings and transcripts live in encrypted storage. Access is restricted to ClickedTools staff and your agency under the engagement contract.
Retention: minimum 2 years for recordings and transcripts, up to 7 years where compliance requires it.
9. Voicemail standards
If the AI hits voicemail, the message is under 30 seconds and always includes caller identity (the agency), AI disclosure, the reason for the call (the lead's opt-in), a callback option, and an opt-out option.
Standard AI voicemail
Hi [Name], this is Christian, an AI assistant calling from [Agency] about the form you filled out. Give us a call back at [number] or reply to our email if you'd like to chat. Or just ignore this and we won't follow up by phone again. Thanks.
10. Frequency caps
Maximum three AI call attempts per lead with no answer, spread over roughly one week, then the lead drops into email-only follow-up. The cap is enforced at the engine level, not at a producer's discretion. State mini-TCPAs and FCC enforcement increasingly treat call frequency as a harassment signal, so we cap conservatively. If a lead opts out at any point, the count stops at zero new calls and the number goes on the permanent suppression list.
11. State-specific configuration
The engine reads state-specific compliance rules from configuration at the moment of dial. The recipient's state is resolved at dial time from the number portability lookup, not assumed from area code or billing address. Examples:
- Two-party recording states (California, Florida, Illinois, Pennsylvania, Washington, and others): the AI delivers the recording disclosure inside the standard opening, before substantive conversation.
- California BOT Act: explicit AI disclosure at the start of every call.
- Florida Telephone Solicitation Act and similar state mini-TCPAs with tighter calling windows or stricter consent requirements: the engine enforces the most restrictive applicable rule.
- Industry-specific rules where they apply (for insurance, this can include state-specific licensing disclosures on the call).
When state rules change, the configuration is updated centrally. Your agency does not need to update producer scripts.
12. Your agency's responsibilities
ClickedTools handles the technical layer. Your agency is responsible for:
- Providing leads only from sources with verifiable TCPA-grade opt-in.
- Hosting consent language on your own forms that names your agency and lists automated calls, AI voice, prerecorded messages, and SMS as channels.
- Keeping your AMS Do-Not-Call list current and synced to our engine.
- Holding the appropriate licenses to sell insurance products in the states you operate in.
- Reviewing call recordings and transcripts when ClickedTools flags a borderline call for human review.
- Telling us when the products you sell, the carriers you represent, or the on-call disclaimers you need change.
We will refuse to dial a list that does not have lead-level opt-in evidence. We will refuse to disable any of the compliance controls above.
13. Site privacy notice
This section covers what happens when you (a visitor) submit a form on clickedtools.com itself, separate from the framework above for client builds.
What we collect
When you submit one of the forms on this site (the hero "Call me in 60 seconds" demo or the booking intake), we collect your name, agency name, email, and (where provided) phone number; technical metadata (IP, user agent, page URL, referring source, timestamp, timezone offset); a snapshot of the consent text you agreed to, the state of the consent checkbox at submission, and the consent version identifier; and, if a demo call goes out, the audio recording, transcript, and per-call log entry from section 8 above. Both forms use an unchecked consent checkbox that you must affirmatively check before the form will submit; the checkbox is never pre-checked.
Why we collect it
To contact you about ClickedTools' services (by AI voice agent for the demo, by Noah personally for follow-up, by SMS, and by email), run the live demo, schedule your consultation, and keep the audit trail required under the TCPA and equivalent rules.
Processors
- n8n (workflow automation, self-hosted on our infrastructure): receives and routes form submissions, triggers calls, and writes call events back to our store.
- Vapi: runs the AI voice agent, the synthesized voice you hear, and the real-time conversation orchestration on outbound calls.
- Twilio and other telephony vendors as required: places the outbound phone calls and SMS.
- Supabase: stores form submissions, consent records, call logs, and the internal Do-Not-Call list.
- Google Analytics 4: website analytics, only if you accept cookies.
- Coalition partners (Arkias Digital, Trivium Studios) may access engagement data on a need-to-know basis if they are working on your build.
We do not sell your personal information. We do not share it for third-party advertising.
Your rights
- Stop calling, texting, or emailing you. Reply STOP to any text, tell the AI to stop on a call (it respects opt-outs immediately under section 7), or email [email protected]. Your number goes on the internal Do-Not-Call list and is honored across all channels.
- See a copy of the data we hold about you, including consent record, call recordings, and transcripts.
- Correct inaccurate data.
- Delete your data, subject to our legal obligation to retain consent records and call logs for the windows above.
- Withdraw consent at any time, without affecting the lawfulness of anything we did before you withdrew it.
If you are in the UK or EU, you also have the right to lodge a complaint with your supervisory authority (in the UK, the Information Commissioner's Office at ico.org.uk). If you are in California, you have rights under the CCPA/CPRA, including the right not to be discriminated against for exercising them.
How to opt out, in one place
Texts: Reply STOP to any of our messages.
Calls: Tell the agent (AI or human) to stop calling. The call ends and your number is added to the internal Do-Not-Call list within seconds.
Email or anything else: Email [email protected] with subject "Opt out" and the number or email address to suppress.
Cookies
This site uses a single analytics cookie via Google Analytics 4, and only after you accept the cookie banner. If you decline, we do not set the analytics cookie. No advertising cookies, no retargeting pixels, no third-party trackers.
Retention summary
- Consent records and form submissions: minimum 4 years, up to 7 years.
- Call recordings, transcripts, per-call logs: minimum 2 years, up to 7 years.
- Internal Do-Not-Call list: retained indefinitely.
- Analytics data: per Google Analytics 4 retention defaults.
International transfers
ClickedTools Ltd is based in the United Kingdom. Some processors above operate in the United States and elsewhere. Where required, we rely on Standard Contractual Clauses and equivalent safeguards to protect transfers outside the UK and EEA.
Changes to this policy
If we change this policy, we update the "Last updated" date at the top and bump the consent version identifier we store with new form submissions. Material changes that affect calling, recording, or opt-out behavior are flagged on the home page before they take effect.
14. Contact
Compliance questions, opt-out requests, data subject requests, or anything else: [email protected]. ClickedTools Ltd, registered in England & Wales.