Hey TomoConsent sounds like a legal word, but the idea is old and simple. A good shopkeeper does not call your home at night to sell you biscuits. They wait until you come in, and they stop offering if you say no. Messaging customers on WhatsApp, SMS, email and push works the same way. This guide explains the rules of thumb Hey Tomo follows, and why.
Opt-in: ask first, and ask clearly
Opt-in means the customer said yes, clearly and on purpose, to hearing from you. A good opt-in has four parts:
- It is their choice. A box they tick, not one you ticked for them. A button they tap, not a line hidden in the terms.
- It is specific. "Order updates on WhatsApp" and "offers by SMS" are separate yeses. Getting one does not give you the other.
- It is informed. Say who you are, what you will send and how they can stop.
- It is not a condition. Do not refuse a sale because someone will not sign up for offers.
Ask where the customer is already making a choice: at checkout, on the booking form, at the counter with a QR code, or when they first open your app. Ask once, in plain words, and only for what you will really send. "Get order updates and the occasional offer on WhatsApp. Reply STOP any time." is clear. A long paragraph of legal text is not, and customers skip it.
Keep a record of consent
If a customer, a channel or a regulator ever asks "why did you message me?", you should be able to answer. For each yes, keep:
- WhoThe customer and the number or email they gave.
- WhatWhich kind of messages and which channel they agreed to.
- When and whereThe date and time, and the place they said yes: the checkout page, the QR code at the counter, the booking form.
- What they sawThe words of the question they agreed to.
Hey Tomo keeps this record on each customer's profile and never deletes consent or opt-out records. Before every message it checks consent, and then it checks again at the moment of sending, in case the customer changed their mind in between.
Stop means stop, in any language
Withdrawing consent should be as easy as giving it. Customers do not always type "STOP". They write what they would say to you in person. Hey Tomo understands a stop request in any language, including Hinglish and Hindi phrases written in English letters, like:
Once someone opts out, they leave every marketing journey for that channel at once. You can send a single short confirmation, for example "You will not get offers from us on WhatsApp any more", and nothing after. See Opt-out in the glossary.
Service, reminders and marketing
Not all messages are equal. It helps to sort every message into one of three kinds:
| Kind | Examples | Quiet hours |
|---|---|---|
| Service | A reply to the customer's question, a one-time code, an order or payment confirmation they are waiting for | May go at any hour, if the owner turns on the 24/7 option |
| Reminders | Appointment, class, renewal or pickup reminders | Keep quiet hours |
| Marketing | Offers, new arrivals, festive sales, win-back nudges | Keep quiet hours |
Quiet hours
Quiet hours are the hours when you do not send marketing or reminders, so customers are not woken or disturbed. In India, TRAI's rules already limit promotional calls and SMS to daytime, and the same courtesy makes sense on every channel.
Hey Tomo keeps quiet hours for marketing and reminders on all channels. If a journey reaches a message during quiet hours, the message waits and goes out when the window opens. Only service messages may use the owner's 24/7 option, because a customer who just asked a question at 11 pm is happy to get the answer.
Under-18s never get marketing
Children deserve extra care. Hey Tomo never sends marketing to anyone under 18, on any channel. Reminders that a child needs, like a class or appointment reminder, can go to a parent or guardian instead. If you serve families, add the guardian's details when you take the booking.
The DPDP Act, in general terms
India's Digital Personal Data Protection Act, 2023 sets rules for how businesses handle personal data, with rules under it being brought in over time. At a general level, it expects that:
- consent is free, specific, informed and given by a clear action;
- people are told what data is collected and why;
- withdrawing consent is about as easy as giving it;
- data is kept safe and only as long as it is needed;
- children's data gets extra protection, including consent from a parent or guardian.
Everything in this guide points the same way. If you would be comfortable explaining your messages to the customer face to face, you are probably on the right track. For anything specific to your business, ask a lawyer.
A quick checklist
- Ask clearlyEvery sign-up form says what you will send and on which channel.
- Record itEach yes is stored with who, what, when, where and the words used.
- Stop at onceAny stop request, in any language, ends marketing on that channel.
- Keep quiet hoursMarketing and reminders go only in daytime.
- Protect childrenNo marketing to under-18s; reminders go to a guardian.
For the long version, read the Consent First e-book. If you send SMS, registering your templates on DLT is the next step.