The policy must say how message content is handled
The requirementstatement
The privacy policy must state how message content is stored, for how long, who can read it, and whether it is used for analytics or AI.
- Severityseverity
- MediumMEDIUMUsually survives review, but lowers your trust score or invites a manual look you would rather avoid.
- When it bitesphase
- Gates approvalapprovalGet this wrong and the brand or campaign is refused at registration.
- What is checkedobject
- privacy policy body
- Where it liveslayer
- Policy pagesPOLICY_PAGE
- How Ekas settles itdetectability
- AI · formAI_FORM
- A semantic question about what you wrote: whether a description matches a use case, whether a name looks like a filed entity. Judged by a model against written criteria.
- What the fix involvesfailureClass
- Fix the policyTERMINAL_POLICY
- The fix lives in your privacy policy or SMS terms. Ekas can generate the missing clauses.
- Who requires itauthorities
- TCR
- When it appliesapplicabilityText
- Applies to every 10DLC registration.
Why this rule existsrationale
Two-way programmes accumulate conversations that people treat as private, and the number of platforms now feeding message content to analytics or model training makes silence on this a live consumer question rather than a formality. A business that has never thought about it usually finds the answer is in its vendor's settings rather than in its own practice.
How to fix itremediation
Add two sentences to the messaging section covering storage, access and any secondary use. Check what your platform actually does before writing them. Done when the policy describes the real handling rather than the intended handling.
A compliant exampleexample
Replies to our texts are stored in our support system for 24 months and are read only by the Acme Coffee support team. We do not use message content for advertising or to train automated systems.
Rules you will hit next
6 other rules read privacy policy body. Fixing one field to satisfy a single rule is how a resubmission trades one rejection for another, so read these before you change anything.
POL-050Privacy policy must state mobile opt-in data is not shared or soldBlockingBLOCKINGPOL-063A policy that says mobile opt-in data is shared is refused outrightBlockingBLOCKINGPOL-078A political brand is held to the same data-sharing banBlockingBLOCKINGPOL-079A charity policy must bar anyone but the charity from using subscriber dataBlockingBLOCKINGPOL-109A cart-reminder programme must say how abandonment is detectedBlockingBLOCKINGPOL-053The clause must say NOT SHARED, not merely "not sold"HighHIGH
POL-104 is one of 157 policy pages rules in the 915-rule 10DLC registry. Free to cite under CC BY 4.0.