Use Wendesk fairly.

TL;DR — The short version.#

• Don't message people who didn't opt in. WhatsApp, SMS, email, voice — all of it.
• Don't use Wendesk to defraud, deceive, or harass. Phishing, scams, deepfakes, harassment campaigns — account closed, evidence preserved.
• CSAM, terrorism, and similar content trigger immediate termination and a report to the relevant authority. No warning, no cure period.
• Some industries need licences (gambling, pharma, financial services, alcohol). If you operate in one, we ask for documentation.
• AI and voice agents have extra rules. No deepfakes-to-deceive, no robocalls, no impersonating real people without consent.
• If something is wrong, write to [email protected]. We acknowledge in 24 hours, act in 72.

1. Scope & who this applies to#

This Acceptable Use Policy ("AUP") governs how every party touching Wendesk is allowed to behave. It binds the workspace owner ("you", "Customer"), every staff member they invite, every custom role they create, every end-user they message through Wendesk, and every storefront published to the Wendesk Marketplace under the Customer's account. Acceptance of the Terms of Service incorporates this AUP by reference; using any part of the platform after the effective date constitutes agreement to the version then in force.

The AUP applies across every Wendesk surface and every one of the seven solutions: CRM, WhatsApp Growth Hub, Content Studio, Social Sharing, Marketplace, AI Voice Agent, and Email Marketing. It applies whether the activity originates from the web dashboard, the WhatsApp Brain command surface, a public storefront, an integration via the App Store, or a Model Context Protocol client connecting through mcp.wendesk.com.

Where a stricter rule exists in a sector-specific addendum (for example, a Business Associate Agreement for a healthcare workspace, or a data-processing addendum referencing GDPR), that stricter rule controls for the activity it covers. Where there is no conflict, both apply.

2. Prohibited content#

The following content is forbidden on Wendesk regardless of how, where, or for whom it is created, stored, sent, or displayed. Detection of any of it — by us, by a sub-processor, or by a credible report — results in immediate suspension and, where applicable, mandatory disclosure to the relevant authority.

• Child sexual abuse material (CSAM). Zero tolerance. Detection triggers immediate account termination, preservation of evidence, and reporting to the National Center for Missing & Exploited Children (NCMEC), India's National Cyber Crime Reporting Portal, and any other competent authority.
• Sexual content involving minors in any form, including written depictions, AI-generated imagery, or sexualised cartoons of identifiable minors.
• Content promoting, inciting, or glorifying terrorism or violent extremism, including recruitment material, beheading or attack videos, and propaganda for designated terrorist organisations.
• Content inciting violence or imminent harm against an identifiable person, group, or location.
• Hate speech targeting people on the basis of race, caste, religion, ethnicity, nationality, sexual orientation, gender identity, disability, or other protected characteristics in the operative jurisdiction.
• Doxxing — publishing private personal information (home address, phone number, government identifier, financial account details, real-time location) without the subject's consent and with the intent or effect of causing harassment.
• Non-consensual intimate imagery ("revenge porn"), including deepfaked pornographic imagery of real people created or distributed without consent.
• Synthetic media designed to deceive — deepfaked audio, video, or text published or sent in a way that could reasonably mislead a recipient into believing it is genuine speech or conduct of a real person, without clear and contemporaneous disclosure that it is synthetic.
• Content that infringes third-party intellectual-property rights — copyrighted works, trademarks, or trade secrets used without licence or other lawful basis. Repeat infringers are terminated under the procedure in section 12.

Why we list this so plainly: Because messaging platforms become a magnet for the worst of the internet the moment they hit scale. The list above is not a discouragement — it is the floor. If your business model depends on any of it, Wendesk is the wrong platform.

3. Prohibited uses#

Independent of the content rules above, the following uses of Wendesk are forbidden:

• Unsolicited bulk messaging (spam). Cold messaging on WhatsApp, SMS, email, or voice without an opt-in basis violates Meta's WhatsApp Business Policy, India's TRAI Telecom Commercial Communications Customer Preference Regulations, the US CAN-SPAM Act, and the EU ePrivacy Directive. We do not host it.
• Phishing and credential harvesting. No messages or pages that impersonate banks, government agencies, well-known brands, or individuals for the purpose of extracting credentials, OTPs, or payment details.
• Fraud and scams. Investment scams, advance-fee fraud, romance scams, fake-job scams, fake-courier scams, "task-based" earning schemes, and similar deception.
• Pyramid schemes and unlawful multi-level marketing. Compensation structures that pay primarily for recruitment rather than the sale of a real product or service are prohibited regardless of how they are framed.
• Money laundering, terrorism financing, and sanctions evasion. Wendesk screens against major sanctions lists; attempting to use the platform to circumvent them is a hard violation.
• Unauthorised scraping or crawling of Wendesk's web surfaces, public storefronts of other tenants, or any third-party site through Wendesk's outbound network.
• Reverse-engineering, decompiling, or attempting to extract weights or training data from Wendesk's machine-learning models, prompt scaffolding, or proprietary algorithms.
• Resale or sub-licensing of Wendesk seats, AI quota, voice minutes, or messaging credits to parties not bound by your Terms-of-Service contract, except where you operate as an authorised reseller or partner under a separate written agreement.

4. WhatsApp obligations#

WhatsApp is the primary channel Wendesk is built around. Every workspace that connects a WhatsApp number — whether through Meta's Cloud API ("Mode B") or via Baileys-based personal-account integration ("Mode A") — must comply with Meta's WhatsApp Business Messaging Policy, the WhatsApp Commerce Policy, and the rules below. These obligations are layered on top of the prohibited-uses list in section 3.

• Opt-in is mandatory. Before sending the first business-initiated message to a number, the recipient must have given the Customer a clear, recorded, and demonstrable opt-in for messages on WhatsApp from that specific business. Pre-checked boxes, "implied" consent from a phone-book scrape, and lead-list purchases do not qualify.
• Opt-out must be honoured everywhere. Replies of STOP, UNSUBSCRIBE, the equivalent in any of Wendesk's seven supported vernaculars, or the WhatsApp "Block" action stop further outbound messaging from the same workspace to that number permanently. Re-engagement requires fresh opt-in.
• Template messages must be approved. Outbound messages outside the 24-hour customer-care window must use templates submitted to and approved by Meta. Sending a non-approved utility/marketing message via a template field forces template rejection and degrades the workspace's quality rating.
• Quality rating must remain healthy. Meta scores every WhatsApp number on a Green / Yellow / Red scale based on user blocks, reports, and message-delivery behaviour. A sustained Yellow rating triggers a Wendesk warning + template-send rate-limit; a Red rating triggers immediate suspension of bulk dispatch until the workspace recovers to Green for a continuous 7-day window. Persistent Red on a workspace is a termination ground under section 11.
• Template categorisation must be honest. Meta classifies templates as Marketing, Utility, or Authentication; pricing differs per category and per market. Submitting a marketing message under a Utility or Authentication template (to dodge cost or to avoid opt-in scrutiny) is misclassification and a termination ground under section 11.
• 24-hour customer-care window discipline. Free-form messages may only be sent to a recipient who has messaged the Customer within the previous 24 hours; outside that window, only approved templates apply. The platform enforces this at the API; circumventing the timer (e.g. by piggy-backing on a Mode-A personal-account session) is prohibited.
• No broadcasts to non-opted-in numbers. Importing a contact list and blasting it is the textbook violation. Wendesk's bulk-messaging tools refuse to dispatch to numbers without a recorded consent timestamp.
• Mode A (personal-account QR) carries an explicit risk-accept. Connecting via Baileys uses your personal WhatsApp account; Meta may rate-limit or ban that number at its sole discretion. The "I accept the risk" checkbox at setup is recorded in BusinessXIntegration.modeAriskAcceptedAt and binds the workspace.

5. Restricted industries & compliance#

Five regimes carry shared duties between us and the tenant. The block below summarises what we do and what you must do. The remainder of this section covers industries we restrict beyond DPDP / GDPR baseline.

Some industries are not categorically banned but are restricted: we permit them only with prior written approval and ongoing documentation showing compliance with the relevant licensing, age-gating, and advertising rules in the operative jurisdiction. The list draws from common payment-processor restricted-business categories (Razorpay, Stripe, and similar) and is updated as we encounter new edge cases.

• Gambling, fantasy sports, and skill-based wagering — only with the relevant state/national licence (e.g. Sikkim or Nagaland licensing in India, UKGC, MGA, NJDGE, etc.). No promotion to minors or to states where the activity is illegal.
• Adult-oriented services — permitted only for legal, properly age-gated content; never for content depicting minors, non-consenting adults, or trafficking.
• Firearms, ammunition, and weapons accessories — only via licensed dealers operating within their jurisdiction; never for civilian sales of restricted weapons or for delivery to jurisdictions where the item is unlawful.
• Tobacco, vaping, alcohol, and cannabis — jurisdiction-dependent. Cannabis is prohibited where it is unlawful; permitted in regulated markets with appropriate licensing. Alcohol and tobacco require age verification and may not be advertised to minors.
• Pharmaceuticals and prescription products — only via licensed pharmacies/practitioners with valid prescriptions; CDSCO and Schedule H/H1/X compliance is mandatory in India. Direct-to-consumer sale of prescription medication without a prescription is forbidden.
• Financial services — lending, payments, foreign exchange, securities, insurance, and crypto require the appropriate licence (RBI/SEBI/IRDAI in India; equivalents elsewhere). Unregulated lending and "shadow" forex platforms are prohibited.
• Multi-level marketing and direct-selling. Permitted only when registered under India's Direct Selling Rules 2021 (or equivalent), with a real product, real returns policy, and a compensation plan that is not primarily recruitment-driven.
• "Get-rich-quick", crypto-trading-courses, and signal services. Permitted only with verifiable credentials, full disclosure of historical results, and clear risk warnings. Guarantees of returns are an automatic decline.
• Political campaigning and referendum content. Permitted with disclosure of the funding entity and within the rules of the Election Commission of the relevant jurisdiction; prohibited for content designed to suppress or disenfranchise voters.

How approval works: Restricted-industry workspaces upload supporting documentation (licence, certification, partnership letter) at signup or before going live. Approval is recorded against the workspace; sensitive features (e.g. mass WhatsApp dispatch, voice campaigns) stay disabled until approval lands. Withdrawal of the underlying licence ends the approval; the workspace returns to standard restricted-industry block.

6. AI restrictions#

Wendesk's AI features — the WhatsApp Brain, Magic Fields, Content Studio drafts, agentic workflow runs, lead-qualification scoring, voice-agent transcripts — can be steered to either useful or harmful outputs. The rules in this section apply on top of every section above and apply identically whether the call uses our included quota, an Enterprise overage line, or a tenant's bring-your-own-key (BYOK) provider.

• No mass-produced misinformation — fabricated news articles, doctored quotes, fake reviews, fake testimonials, manufactured "case studies", or astroturfing campaigns.
• No deepfakes used to deceive. Voice cloning of a real person without their recorded consent, video face-swaps used to attribute statements, or photorealistic imagery of identifiable people in places or situations they were never in — all prohibited.
• No spam, phishing, scam, or harassment scaffolding. Using a Wendesk AI feature to draft thousands of personalised cold messages, phishing pages, scam scripts, or harassment campaigns is a violation regardless of whether the messages are actually sent through our channels.
• No NSFW or sexually explicit generation. Wendesk's AI guardrails refuse it; attempting jailbreaks to bypass those guardrails (prompt injection, role-play exploits, encoded payloads) is a violation in itself.
• No unauthorised impersonation. AI-generated content that pretends to be a real, identified person speaking in their own capacity requires their documented consent.
• No model extraction. Probing Wendesk's models with the goal of reconstructing training data, embeddings, system prompts, or scaffolding logic is a violation. Standard product use, including scripted use within your plan limits, is fine.
• Healthcare workspaces — PHI is auto-redacted before any prompt reaches a third-party model. Disabling or evading that redaction is prohibited. Use the on-platform self-hosted Llama route for prompts that legitimately require PHI context.

7. Voice agent restrictions#

The Voice Agent (early access) places automated outbound and inbound calls through one of eight regulated telephony providers via our smart router. Voice is the most heavily-regulated channel on the platform; the rules below are non-negotiable and reflect the strictest of the applicable regimes.

• Recipient consent is mandatory for outbound automated calls. Comply with India's TRAI National Customer Preference Register (NCPR), the US Telephone Consumer Protection Act (TCPA), the EU ePrivacy Directive, and equivalents in any market you operate in.
• No calls to do-not-call (DND) numbers outside an existing-business-relationship exemption that is properly recorded and verifiable.
• Caller-ID must be honest. No spoofing of numbers you do not own or control. No spoofing of bank, government, or emergency-service numbers under any circumstance.
• Calling-window discipline. Outbound campaigns respect the recipient's local time-of-day rules — in India, outside 09:00–21:00 IST is generally prohibited; in the US, outside 08:00–21:00 local time is prohibited under TCPA.
• No impersonation of real individuals via voice cloning without that individual's recorded consent. The voice-agent persona is identified as automated at the start of the call when the recipient asks.
• No harassment or threatening calls. Repeat-call escalation to the same recipient after a "do not contact" reply, abusive debt-collection scripts, threats of legal action that are not actually being pursued, or any call designed to intimidate, are prohibited.
• Recordings handled per the Privacy Policy. Recipient must be informed at the start of the call where the law (e.g. India's two-party consent expectation for sensitive calls) requires it. Recordings are encrypted at rest and retained per the workspace's retention setting (default 90 days; 6 years for healthcare).

8. Marketplace storefront restrictions#

Storefronts published to the Wendesk Marketplace under www.wendesk.com/m/store/[tenantSlug] are public commerce surfaces. They are subject to a stricter content bar than internal CRM data and must comply with both this AUP and the rules of the payment processor handling transactions.

• Products must comply with the laws of every jurisdiction they are listed in or shipped to. The Customer is responsible for blocking or geo-restricting products where they cannot be lawfully sold.
• No counterfeit or replica goods. Items that copy a third party's brand, design, or trade dress without licence are removed on detection or report.
• No stolen goods, recovered-from-crime goods, or items of doubtful provenance (e.g. cultural artefacts without export documentation).
• No controlled substances outside the licensed-pharmacy carve-out in section 5.
• Honest descriptions and honest pricing. Pricing tricks — fake "was" prices, hidden mandatory fees, drip-pricing — will trigger a takedown after one warning. Prices must be inclusive of mandatory taxes where the law requires (e.g. India GST on consumer-facing pricing).
• Truthful imagery. Stock photos may be used for representative purposes but the listing must clearly disclose when the actual item differs in colour, finish, or grade from the imagery.
• Returns, refunds, and dispute paths must be published on the storefront and must comply with the Consumer Protection Act 2019 (India) or the equivalent regime in the buyer's jurisdiction. Wendesk is the platform; the Customer is the seller of record.

9. Security & integrity#

Wendesk's security posture depends on the boundary between us and our customers staying intact in both directions. The following are forbidden:

• Denial-of-service attacks — volumetric, application-layer, or slowloris-style — against any Wendesk endpoint or any third party from a Wendesk workspace.
• Brute-force or credential-stuffing against Wendesk login surfaces or third-party services accessed via Wendesk.
• Penetration testing or vulnerability research without prior written permission. Use the coordinated disclosure programme at /security — we ask for an email first; testing without consent is unauthorised access under India's IT Act and the equivalent statutes elsewhere.
• Exploiting a discovered vulnerability beyond the minimum proof needed to report it. "Exfiltrate first, report later" is treated as malicious access.
• Sharing API keys, JWTs, OAuth tokens, or workspace secrets in public repositories, public chat channels, or any place where they can be read by an unauthenticated third party. Leaked credentials are revoked; the Customer is responsible for any usage between leak and revocation.
• Using Wendesk infrastructure to attack third parties — for example, sending phishing from a Wendesk-hosted domain, hosting C2 traffic in a custom integration's webhook handler, or using the outbound-call gateway as a launch point for fraud calls.
• Circumventing rate limits, plan caps, or quota enforcement by creating multiple free or trial accounts, by rotating sub-organisations, or by automating signups.
• Tampering with audit logs, security-event logs, or billing logs stored on the platform, or interfering with the integrity of cross-tenant systems.

10. Account integrity, App Store, MCP, CA Partner portal#

Each Wendesk workspace must correspond to a single, real, identifiable Customer entity. The integrity of the platform — for billing, for compliance, for trust & safety — depends on it.

The following are violations: creating accounts under a false name or false business identity; transferring an account to a different controlling entity without going through the Wendesk-mediated transfer process; using one account to circumvent suspension on another; coordinating two or more accounts to evade per-workspace caps; and impersonating another Wendesk customer (for example, by registering a tenant slug or branded subdomain that imitates an existing brand).

Wendesk reserves the right to ask for identity documentation, business registration documentation, or proof of legitimate operation at any time, particularly when signals (payment-method fingerprint reuse, IP collisions, behavioural patterns) suggest a single party is operating multiple accounts to evade limits.

App Store integrations (90 connectors)

The Wendesk App Store ships 90 vetted integrations across CRM, accounting, e-commerce, telephony, support, and marketing categories. Connecting an integration creates an OAuth or API-key credential that is encrypted at rest with the tenant's Data Encryption Key (DEK). The following are violations: connecting a third-party app's credential that you do not own or are not authorised to use; using a connector to exfiltrate customer data outside the Wendesk trust boundary in a way that breaches the connector's own terms; using a connector to push spam, malware, or unsolicited communications onto a third-party platform; or attempting to discover, replay, or extract another tenant's encrypted credential.

MCP server (mcp.wendesk.com)

The MCP server exposes Wendesk capabilities to authorised AI agents through the Model Context Protocol. Every call is authenticated, scoped to a tenant, and audit-logged. Violations include: connecting an MCP client with credentials you do not own; using MCP to read or write data outside your authorised scope; bulk-extracting tenant data via repeated tool calls in lieu of the official export flow; and constructing prompts designed to elicit Wendesk system prompts, scaffolding, or other tenants' data.

CA Partner portal (cabal.wendesk.com)

Verified Chartered Accountants holding the ca-partner custom role have scoped access to a tenant's financial-reporting data only — invoices, GST returns, P&L, statutory ledgers. Violations include: viewing or extracting non-financial CRM, conversational, or operational data; using tenant data outside the engagement letter signed with the tenant; sharing access credentials with non-CA staff; and using the portal to up-sell, cross-sell, or solicit Wendesk's other tenants. CA Partner sessions are recorded under the impersonation audit and surfaced to the tenant in the monthly compliance digest.

11. Reporting violations#

If you believe a Wendesk workspace, a marketplace storefront, an outbound message you received, or any other surface tied to Wendesk is violating this AUP, write to [email protected] with the following:

• The URL, phone number, message ID, or storefront handle of the offending surface.
• What rule you believe is being broken, and a brief description of why (one or two sentences is fine).
• Any evidence you can share — screenshots, message excerpts, the message ID returned by WhatsApp/SMS gateway, or a timestamp.
• Whether you are the affected party, a witness, or reporting on behalf of someone else (with their permission).
• How we can reach you for follow-up. Anonymous tips are accepted; verifiable identity speeds triage.

SLAs: We acknowledge every report within 24 hours. Initial triage and the first action (warning, restriction, suspension, or escalation) lands within 72 hours for standard reports and within 4 hours for high-severity reports involving CSAM, ongoing fraud, or active security incidents. Where the report involves a regulated authority's involvement (cyber-crime, NCMEC, etc.) we file in parallel.

Other channels: [email protected] for legal-process matters; [email protected] for customer-support questions that are not abuse reports. Mis-routed reports are forwarded internally; we do not penalise a reporter for sending to the wrong address.

12. Enforcement#

The default enforcement path is graduated. We open with a private, written warning to the workspace owner naming the rule and the action expected to cure (typically: stop the activity, remove the content, contact the affected parties). The cure window is normally seven (7) days; in some cases (e.g. an ongoing attack) we will require immediate action.

If the cure window passes without compliance, we move to suspension: the workspace is locked from outbound activity (no new messages, no new calls, no marketplace listings), but data is retained and access for read-only review remains. Repeated or unrepaired violations result in termination per the Terms of Service.

Some violations skip the warning step entirely and trigger immediate suspension or termination. These are: CSAM and child-safety violations; active fraud or scam campaigns; security attacks against Wendesk or third parties; sanctions or AML violations; and any conduct presenting an imminent risk of harm to a third party.

On termination, Wendesk preserves account data per the ordinary retention schedule in the Privacy Policy and may extend retention where required by law, by court order, or to support a pending investigation. Refunds on terminated accounts follow the Refund & Cancellation Policy: termination for AUP violation does not entitle the Customer to a refund of fees paid for periods prior to the termination decision; pre-paid time on the cancelled subscription cycle is retained as agreed liquidated damages, not as a penalty.

13. Cooperation with law enforcement#

Fourteen Cloud Pvt Ltd ("Wendesk") responds to lawful subpoenas, search warrants, court orders, and regulator requests from the courts and authorities of the jurisdictions where we are subject to process — principally India, the United States in respect of US-residents' data routed through US sub-processors, and the European Union under the relevant data-cooperation frameworks. Requests received are reviewed by counsel; non-compliant requests (for example, overbroad demands lacking jurisdiction) are challenged.

Where the law allows, Wendesk notifies the affected Customer of a request that targets their data so they can object on their own behalf. Where the law forbids notice (e.g. a non-disclosure order accompanying a warrant), we comply with the gag while it is in force and notify as soon as we are permitted.

Wendesk publishes an annual transparency report summarising the volume and nature of government requests, the proportion responded to in full, in part, or refused, and the categories of data produced. The report is anonymised and aggregated; individual workspace data is never disclosed in it.

14. Customer responsibility for end-users#

The Customer is the first line of compliance for the AUP across the people they bring onto the platform. That is not a disclaimer — it is structurally true, because the Customer (the workspace owner, L4) is the only party who knows their own staff, their own customers, their own end-users, and their own sub-organisations.

Concretely, the Customer is responsible for: ensuring every staff member with workspace access has read and accepts this AUP; configuring industry-appropriate guardrails (consent capture, calling windows, opt-in records) before going live; supervising the storefronts and sub-organisations they publish under their account; promptly removing or suspending users who violate this AUP; and responding to abuse complaints forwarded by Wendesk within the timeframe stated in that forwarded message (normally seven days).

Where a Customer does not act on a forwarded abuse complaint within the stated window, Wendesk may act on the underlying user, content, or sub-organisation directly under section 12. Repeated failure to govern end-users escalates to action against the Customer's own account.

15. Updates & versioning#

We may update this AUP to reflect changes in law, in the platform, in our sub-processors' rules, or in the threats we encounter. Material changes — new prohibited categories, new restricted industries, changes to the enforcement ladder, or substantive amendments to the consent rules — are announced at least fourteen (14) days before taking effect, by email to the workspace owner and a notice in the dashboard. Non-material changes (typo fixes, restructuring, clarifying examples) take effect on publication.

Every published version is dated and version-numbered at the top and bottom of this page. Continued use of Wendesk after a material change takes effect constitutes acceptance of the new version. A Customer who does not accept a material change may terminate per the Terms of Service before the effective date and request a refund of pre-paid unused time per the Refund & Cancellation Policy.

16. Contact#

The right address depends on what you need:

• Abuse reports, AUP violations, urgent trust-and-safety matters — [email protected]
• Legal process, subpoenas, regulator correspondence, AUP interpretation questions from counsel — [email protected]
• Customer-support questions that are not abuse reports — [email protected]

Postal correspondence to the controller and provider:

Fourteen Cloud Pvt Ltd
Attn: Trust & Safety
Jaipur, Rajasthan, India

Final word: This policy exists so that Wendesk stays useful for the customers who use it well, and inhospitable to the ones who would weaponise it. If you are operating in good faith, you will never collide with this page. If you do, write to us — we would rather fix the misunderstanding than enforce.