> ## Documentation Index
> Fetch the complete documentation index at: /help/llms.txt
> Use this file to discover all available pages before exploring further.

# Sending rules and consent

> Who you may text, email or message, and what Kerux does on every channel so the lawful path is the default: consent, quiet hours, opt-outs, unsubscribe links, do not contact and deletion requests.

You are the sender of every message that leaves your workspace, and you are responsible for having the right to send it. Kerux helps: it applies the rules below on every channel, and when it holds something back it always says why and what fixes it (never a silent drop).

> [!WARNING]
>
> These rules help, they don't replace the law or legal advice. Cold texts and cold WhatsApp messages are not allowed: in the United States the TCPA requires prior express written consent for marketing texts, and carriers block numbers that text people who didn't agree. Never text or WhatsApp bought, rented or scraped phone lists. Kerux's [Acceptable Use Policy](https://www.usekerux.com/acceptable-use) and [Terms](https://www.usekerux.com/terms) say more.

## Set who sends

Go to **Settings > Sending rules**. Everyone in the workspace can open it; only owners and admins can change **Who sends** (the others see **Only owners and admins can change this.**). Fill in:

* **Company name**: the name people know you by. The unsubscribe page of your emails shows it, and the first text a contact gets starts with it (text messages are coming soon).
* **Postal address (required for emails)**: your street address, a P.O. box or a registered private mailbox. US law (CAN-SPAM) requires a valid postal address in every commercial email, so Kerux adds it on one small line under the opt-out line of every campaign email. Booking confirmation emails show it after your company name, and a new **Footer** block in your [email template](/help/campaigns/email-templates.md) starts with your company name and this address (you can edit them in the block).
* **Language of the email footer**: English, Spanish, German or French.

Then click **Save**. Campaign emails need the postal address (texts will need the company name). While it is missing, the page says **Emails wait until your postal address is set, and texts until your company name is set.**, and:

* the checks before launch block a campaign with an email step, with **Who sends is missing: a postal address** and a **Fix** link to this page;
* emails already on their way wait with **Waiting for who sends in Settings > Sending rules: add your postal address (emails) or company name (texts)** and show in **Needs attention** with **Open Sending rules**. They go on by themselves once you save.

No campaign email is sent without a postal address.

A postal address must look like one: a link, an email or a few letters without a number is refused with **Type a real postal address (street and number, a P.O. box or a registered private mailbox), not a link or an email.**

## Text messages (SMS)

> [!NOTE]
>
> **Coming soon.** Text messages aren't available in Kerux yet, and nothing is charged for them. The rules below apply once texting opens. Until then, contacts at a **Send SMS** step wait with **Waiting for text messages to open in Kerux (coming soon): nothing is sent or charged, it goes on by itself**. You can already record consent for texts.

* **Only to contacts with a recorded consent** for their current phone. A contact without one waits at the **Send SMS** step with **Waiting for consent: texts go only to people who agreed. Record it on the contact**. Before launch, the checks say how many contacts would wait.
* **Only in the contact's daytime**: from 8:00 to 21:00 in their own time; from 8:00 to 20:00, and at most 3 texts a day, in Florida, Oklahoma and Maryland. Kerux reads where they are from their LinkedIn location and their phone's area code; when the two disagree, or it can't tell, it only texts at an hour that is fine in every place they could be.
* **The first text names you and says how to stop**: the first text a contact gets in a campaign gets your company name in front ("Northwind: ...") and "Reply STOP to opt out." at the end, unless your text already has them.
* **STOP is honored at once**: STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT, REVOKE, OPT OUT, and plain words like "stop texting me", "remove me" or "wrong number" (also in Spanish, German and French). That phone is never texted again from this workspace, and its consent no longer counts. Texting START undoes it.
* **An owner or admin confirms the rules** (consent, STOP, A2P 10DLC registration of your US numbers) by ticking a box in the Twilio panel (**Integrations > Connections**) the first time Twilio is connected. It is a statement for the whole workspace, so members can't make it: they see **Only an owner or admin can connect Twilio the first time...** and can change the keys once an admin has connected it. Until it is confirmed, SMS campaigns can't launch and texts wait. See [Twilio (text messages)](/help/integrations/twilio-sms.md).

## WhatsApp

Only to contacts who gave you their number and agreed, or who wrote to you first on WhatsApp (that counts as their consent for that number). A message asking to stop ends WhatsApp messages to that number. A contact without consent waits at the **Send WhatsApp** step with **Waiting for consent: WhatsApp goes only to people who agreed. Record it on the contact**. The ban-risk warning still applies: see [Connect WhatsApp](/help/getting-started/connect-whatsapp.md).

## Where consent comes from

On each contact page, **Consent and contact** shows whether they agreed to texts and to WhatsApp, where it came from, who recorded it and when. Consent is recorded:

1. **By itself from a form**: a lead form question about texts or WhatsApp answered yes (for example a checkbox "I agree to receive text messages"). The question's words are kept as what they agreed to.
2. **By itself when they write first**: a text or WhatsApp message from the contact's phone, or START.
3. **When you import**: on the last step of an import (**3. Import**), under **Consent to texts or WhatsApp (optional)**, tick **They agreed to get texts (SMS)** or **They agreed to get WhatsApp messages**, then **I confirm these people gave us this consent, and I can show how if asked.** A column such as `sms_consent` or `whatsapp_consent` with `yes`, imported as a custom field, also counts for that row. Only rows with a phone get a consent. Only do this when every person really agreed.
4. **By hand**: on the contact page, under **Consent and contact**, tick **Texts (SMS): the contact gave consent** or **WhatsApp: the contact gave consent**. Kerux keeps your name and the time, for the contact's current phone. Untick it to withdraw it. For many contacts at once, tick them in **Contacts > Database** and choose **They agreed to...**. When you add contacts to a campaign, the checklist line about consent has a **They agreed** button that does the same for the contacts you're adding. The contact needs a phone with its country code first (type it under **Details** and click **Save**). Members, admins and owners can do this; viewers only see it.
5. **By API**: `POST /v1/leads/{id}/consent` with `channels` and `attest: true`.
6. **For the whole workspace**: in **Settings > Sending rules**, under **Contacts' consent**, turn on **Texts (SMS)** and/or **WhatsApp**, tick **I confirm these contacts agreed to get these messages from us.** and click **Save** (owners and admins). Every contact you add from then on counts as agreed on those channels, with no step per contact. Tick **Also my current contacts** to cover the ones already in the workspace too. The contact page shows **Workspace setting** as where the consent comes from. A STOP reply, the do-not-contact list and unticking the consent on a contact page still win for that contact. Turn it off the same way. Only use it when everyone you add really agreed (for example, they all signed up on your own form).

A consent is for one phone: if you change the contact's phone, record it again.

## Email

Every campaign email ends with one short line, for example: Not interested? Reply "unsubscribe" and I won't email you again. Your postal address goes on one small line under it. In HTML emails the word is also this email's unsubscribe link, and mail apps show their own one-click unsubscribe. One click on the link, or a reply that says "unsubscribe", stops every email to that address from this workspace at once (the law allows up to 10 business days; Kerux does it immediately). Smartlead steps never get an address that unsubscribed. See [Write and send emails](/help/campaigns/send-email.md#the-footer-and-the-unsubscribe-link).

## Do not contact

On a contact page, **Do not contact** (members, admins and owners; Kerux asks first) stops every channel, LinkedIn included: their email, phone and LinkedIn profile go on the workspace's do-not-contact list, their consent is withdrawn, and they leave every campaign right away. A reply that Kerux reads as **Stop writing** (see [Reply types](/help/inbox/reply-types.md)) does the same by itself. No campaign takes them again (their history says **Not added to the campaign: on the do-not-contact list**), and the checks before launch count them.

Every step checks the list right before it acts: emails, texts, WhatsApp, Smartlead-type steps, and every LinkedIn step (invitation, message, InMail, follow, like, and profile visit, since LinkedIn shows the person who visited). Automatic answers to replies check it too. A step that finds the person on the list for every channel is never tried: the contact leaves the campaign and its history says **Not sent: on the do-not-contact list**.

**Settings > Sending rules** shows the whole list: unsubscribes, STOP texts, opt-out replies, deletion requests and entries your team added. Members, admins and owners can add emails or phones under **Add to the do-not-contact list**: one per line (phones with their country code), pick **Every channel**, **Email**, **Texts (SMS)** or **WhatsApp** in **For**, and click **Add**. An entry for **Every channel** works like **Do not contact**: contacts with that email or phone are marked do not contact and leave every running campaign at once (the page says how many). An entry for one channel only stops that channel's steps; the rest of the campaign goes on.

Owners and admins can remove entries people added: **Added by a teammate** (on this page or with **Do not contact**) and **Added through the API**. A person's own request (an unsubscribe, a STOP, an opt-out reply, a deletion) can't be removed, because that would contact someone who said stop.

## Deletion requests (GDPR)

When someone asks you to delete their data, open the contact and click **Delete on request (GDPR)** (owners and admins). Kerux asks first; it can't be undone. Kerux deletes the contact and everything it holds about them in this workspace:

* their details, custom fields, tags, notes, tasks, AI research and enrichment results;
* their campaign history, timeline and queued steps (nothing queued goes out), and their consent records;
* inbox conversations with them on every channel (LinkedIn, email, WhatsApp and text) and every message, voice note and reaction in them;
* comments they wrote on your LinkedIn posts (see [Comment automation](/help/campaigns/comment-automation.md));
* LinkedIn invitations they sent you, and the notifications about them;
* lead ad form submissions, email opens and clicks, meetings that were only with them and possible meetings about them;
* outgoing webhook events about them and their delivery logs, payloads that reached your listener steps, saved API replays that show them, and their rows in import error reports.

What has to stay so the request keeps working is kept without anything readable:

* their email(s), phone and LinkedIn profile become one-way hashes on the do-not-contact list (shown as **Deleted person (kept as a hash)**). An earlier unsubscribe or STOP becomes a hash too, so emails and texts to them stay blocked; if an import or a form adds them again, no campaign takes them;
* a form submission and what the LinkedIn checks saw keep only a hash of their id, so a resent form or the next check never brings them back.

The audit log (**Settings > Audit log**) records who did it and when, with the contact's internal id and how many items were removed, never the person's data.

> [!WARNING]
>
> Kerux can only delete what is in Kerux. Messages on LinkedIn or WhatsApp themselves, emails in your own inbox, texts in your Twilio account, and copies you already sent to other tools (your CRM, Smartlead, a webhook, a spreadsheet) stay there: delete them in those tools. If the person writes to you again, the new message shows up in the inbox as usual. Consent records are deleted too: if you need proof of consent for a legal claim, export it first.

## API

`GET` / `PUT /v1/workspace/sending-identity`, `GET` / `PUT /v1/workspace/consent-default` (the workspace's consent switch: an API key can read it and turn it off; turning it on is done by an owner or admin in **Settings > Sending rules**), `GET` / `POST /v1/leads/{id}/consent`, `DELETE /v1/leads/{id}/consent/{channel}`, `POST /v1/leads/{id}/do-not-contact`, `POST /v1/leads/{id}/erase` (answers with what was removed, as counts), `GET` / `POST /v1/suppressions` (an `all` entry also answers with how many contacts were marked do not contact and campaigns they left) and `DELETE /v1/suppressions/{id}` (owners and admins; only entries with `removable: true`). See the [public API](/help/developers/api.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.