Zoril SMS Terms of Service

1. Service and agreement

These terms govern Zoril SMS at sms.zoril.app, including organisation accounts, contacts, messaging, campaigns, automations, reporting, the API, Android gateways, optional AI tools, payments and support. Zoril SMS is under Zoril Systems and managed by Gophine Services Uganda Company Limited, with an office at Anzevu, Eruba, Vurra, Arua, Uganda. By using the service for an organisation, you confirm you have authority to act for it.

Any separately agreed written service or commercial agreement takes precedence where it expressly differs. The Privacy Policy explains how information is processed. Features depend on the plan, configuration and deployment; these terms do not promise every feature to every account. Do not use the service if you cannot accept these terms.

2. Accounts and administrator duties

Provide accurate account information and complete required email verification. Protect your sign-in, API keys, device credentials and webhook secrets. Notify support of suspected compromise and revoke affected credentials. You are responsible for activity performed by your authorised members and integrations.

Organisation administrators manage contacts, consent, access, plans and devices. Use the least access required and remove former team members promptly. A platform administrator may assign a plan or restrict an account; creating an account does not entitle it to every feature or unlimited use.

3. Acceptable messaging

Send only lawful messages to recipients you are authorised to contact. Do not send spam, scams, deceptive sender identities, harassment, illegal material, malicious links or content that violates another person's rights. Do not bypass opt-outs, carrier limits, billing checks, rate limits or security controls.

• Marketing: obtain the required consent, retain evidence, clearly identify the sender and provide an appropriate unsubscribe method. Never send promotional messages to opted-out or suppressed recipients.
• Transactional notices: use an appropriate lawful basis and send only information relevant to the transaction or service. Adding a promotion can change the legal requirements; calling it transactional does not exempt it.
• Country/carrier rules: check Uganda's data-protection and communications requirements and the recipient country's rules, including timing, registration and sender requirements. Platform controls do not replace this assessment.
• Data minimisation: do not upload unnecessary identity, health or financial information, passwords or payment PINs. Only connect integrations you are authorised to use.

4. Plans, trials and payment

Available plans, monthly UGX prices, messaging rates, trial periods, feature permissions and usage caps are administrator-controlled. The current offer and your organisation's assigned plan and renewal/trial information appear in Pricing and Billing & Usage. Do not rely on old examples or documentation for a fixed allowance.

Yo! Uganda is used for supported mobile-money payments and top-ups. Credits are applied after verification of payment; a submitted request or pending payment is not proof of success. Use your payment reference when raising a dispute and never send a mobile-money PIN to Zoril support.

SIM airtime/bundles and carrier charges are separate from platform fees. Message length and encoding can result in multiple carrier SMS parts. Previews are estimates unless confirmed by actual billing records. We do not promise automatic overage billing, automatic renewal or refunds beyond what the applicable offer, written agreement or law provides. Ask support to resolve an incorrect charge or clarify cancellation/refund arrangements before purchasing.

A trial ending, an expired subscription, a suspended account or exhausted allowance/credits may prevent sending. Review pending campaigns before changing plans. Commercial changes apply as communicated or agreed and remain subject to applicable law.

5. Contact lists and personalisation

You are responsible for the lawful source, accuracy and necessary scope of imported contacts, custom fields, consent evidence and integration-supplied information. Duplicate detection, number normalisation, saved segments and industry templates do not certify a number's ownership, consent or eligibility. Check imports and merges before relying on them.

Review the final recipients and personalised text before sending. Groups, recently sent lists and saved templates are conveniences, not renewed permission to contact someone. Check opt-outs and consent for every campaign, repeated send and integration. Protect sensitive fields with the appropriate access controls; do not expose private financial, health or identity information through SMS or unrestricted fields.

Downloaded CSV, spreadsheet and report exports are your responsibility after download. Keep them secure, limit access and honour retention/deletion obligations. Import validation and spreadsheet protections reduce risks but do not guarantee that every file or downstream use is safe.

6. Campaigns and automated sending

Scheduling, recurrence, group sending, keyword replies, journeys and workflow rules can send messages without a further manual action once enabled. You are responsible for recipients, content, consent, trigger conditions, time settings, frequency and adequate account/SIM resources. Test rules with authorised numbers and monitor results before enabling large or recurring sends.

Batch processing, priorities, retries, gateway failover and recovery controls are bounded safeguards, not a promise that an expensive campaign cannot incur charges or create repeated delivery. Review uncertain send attempts before retrying or restoring dead-letter work. Pausing or cancelling stops eligible pending work only; already submitted SMS cannot be recalled. Scheduled times are subject to queue capacity, gateway throughput and connectivity, not exact-second delivery.

Marketing safeguards vary by sending path. Campaign workflows apply configured sender and opt-out controls; the public single-send API does not automatically add a marketing footer or establish consent. Never bypass a suppression, relabel a promotion as transactional, or assume a template fulfils destination-country rules.

7. Gateways, sender identity and delivery

The current gateway sends SMS through paired Android phones and their SIMs. You must own or be authorised to use the device/SIM, maintain power and connectivity, grant necessary permissions and comply with carrier rules on automated or bulk messaging. SIM airtime and SMS bundles remain your responsibility. Routing policies and sender-ID configuration do not create a new carrier service or guarantee provider approval.

The originating number is normally the SIM number. A branded sender ID requires an approved compatible provider route; a sender name in message text does not replace the originating number. Do not impersonate another sender or use an identifier you are not authorised to use.

A gateway can forward incoming SMS to the organisation. Use a dedicated phone and SIM, inform affected users and do not connect a personal device whose private messages or verification codes would be captured. Inbox availability does not guarantee a human response; maintain a separate channel for urgent matters.

Queued means accepted for processing; sent means the gateway reported sending; delivered means a delivery report was recorded. Reports may be missing or delayed; no status proves reading. Test/simulator results are not real network delivery. Ordinary SMS is not end-to-end encrypted and is unsuitable for secrets or highly sensitive data.

Internal processing may repeat after interruptions. Idempotency and reconciliation reduce duplicates but do not guarantee exactly-once delivery. No uptime or delivery service-level guarantee is created by this page. Use a separate written agreement where required, and do not rely on the service as the only emergency or safety-critical channel.

8. API keys and webhooks

Use API keys only within their authorised organisation and plan. Store keys and device/webhook credentials securely, rotate or revoke them after compromise and do not publish them in browser scripts or public repositories. Test keys simulate delivery but may still be subject to feature and request limits; they do not prove carrier readiness.

Your integration must validate inputs, respect rate limits, use stable idempotency keys for retries and reconcile uncertain results before resending. Do not circumvent daily, monthly, campaign, API or device limits by splitting requests across accounts or credentials.

Secure webhook receivers, verify signatures against the raw request body and prevent repeated side effects. You choose the destination and are responsible for its access and retention practices. Events and attempts may be delayed, retried or fail. Third-party systems have their own terms and availability constraints; enabling an integration authorises the data transfer needed for its configured operation.

9. Templates, AI and intellectual property

You retain responsibility for your contact lists and message content and authorise processing needed to provide the configured service. Only use content you are entitled to use. Do not copy, resell or misuse service branding or software except where your agreement or an applicable licence permits it.

Industry templates, optional Google Gemini suggestions, inbox analysis and campaign recommendations require human review. They may be inaccurate or inappropriate and do not establish consent, sector compliance or a guaranteed outcome. Do not submit secrets or unnecessary sensitive data to AI operations. Processing by Google is subject to applicable third-party terms and data arrangements described in the Privacy Policy.

AI-assisted drafts or recommendations do not relieve you of responsibility for the message ultimately sent or the automation you enable. Review merge fields, fallbacks and final recipient previews before approval.

10. Reports and tracked links

Usage, delivery, reply and campaign reports reflect available service records. Estimates, missing delivery reports and untracked outcomes must not be treated as verified results. A click or delivery status does not prove a sale, payment, appointment or that the intended person read the SMS.

If you enable tracked links, explain the collection of click/request information and meet applicable notice, consent and choice requirements. Referral attribution and promotional credits are subject to the applicable offer and administrator configuration, not a promise of an automatic reward. Do not manipulate referrals, traffic or usage records to obtain benefits.

11. Suspension, deletion and records

We may restrict or suspend access for suspected abuse, compromise, non-payment, legal obligations or operational risk. Ask support about investigation or reactivation. Where feasible we will explain the issue, but urgent protective action may be necessary. Reactivation does not guarantee recovery of cancelled or missed sends; review pending work before resuming.

Before requesting permanent organisation deletion, stop campaigns/automations, export only records you are entitled to retain, revoke keys and integrations and resolve outstanding operational or legal obligations. An authorised platform administrator can delete the organisation and its associated data and optionally eligible user accounts. Accounts shared with other organisations, protected platform administrator accounts and the acting administrator's account are excluded from that user-deletion option.

Permanent deletion may not be recoverable and does not cancel lawful payment obligations or erase independent copies held on phones, in exports, backups or third-party systems. Platform audit/security records and legally required records may be retained as described in the Privacy Policy. Arrange any necessary legal retention before deletion; do not assume the platform can restore deleted records.

12. Security, backup and incidents

Use least-privilege team access, protected devices and secure credentials. Promptly report suspected account compromise or data exposure through support without including secrets. Revoke affected keys and stop unsafe automations when appropriate. Organisation and platform roles, logs and import protections reduce risk but do not guarantee absolute security.

Keep lawful, secure copies of critical business records and maintain a continuity plan. Backup availability and restoration depend on hosting configuration and any written agreement; these terms create no fixed recovery-time or recovery-point guarantee. Customer-managed deployments are responsible for their hosting settings, database updates, scheduled jobs, backups and provider credentials. Required incident reporting under applicable law remains each party's responsibility for processing it controls.

13. Responsibility and disputes

You are responsible for lawful use, recipient permissions, contact accuracy and the condition of your gateways. We are responsible for our obligations under applicable law and any written agreement. We do not guarantee uninterrupted service, universal carrier acceptance or particular campaign outcomes.

To the extent permitted by law, neither party is responsible for indirect or consequential losses caused by matters outside its reasonable control. Nothing in these terms excludes liability or consumer/data-protection rights that cannot lawfully be excluded. A separate written agreement may define additional remedies or limits.

These terms are governed by the laws of Uganda, subject to mandatory rights that may apply elsewhere. Raise service or billing disputes through support first, with the relevant organisation and reference information. Unresolved matters remain subject to the competent courts and applicable law.

14. Updates and contact

We may revise these terms to reflect service or legal changes. Review the current version when your use changes; material contractual changes remain subject to any required notice and agreement. For support, payment disputes or policy questions, use https://zoril.app/#contact. Do not include passwords, full API keys or unnecessary recipient data in a support request.