Skip to main content

How Xagle handles SMS opt-in (A2P 10DLC compliance)

How Xagle handles SMS opt-in

Xagle is a SaaS platform operated by Square Pig LLC. Our customers (Business Users) use Xagle to send transactional SMS to their own pre-existing clients — for invoice notifications, appointment reminders, quote updates, and two-way replies. Xagle does not initiate outbound SMS to consumers; every outbound message originates from a Business User acting on their own client relationship.

This page documents the three pathways by which a Business User records SMS consent for one of their clients. All three converge on a single platform-level enforcement point: every outbound SMS is blocked at the message-send layer unless the client record's consent checkbox is checked.

Method 1 — SMS opt-in (express written)

From the client edit screen, the Business User clicks the Request Consent via SMS button. Xagle sends one transactional SMS to the client's mobile number:

"Hi {Client Name}, this is {Business Name} via Xagle. We'd like to send you transactional SMS for invoices, appointments, and quotes. Reply YES to opt in, STOP to decline. Reply HELP for help. Msg & data rates may apply."

If the client replies YES (or OPT IN, OPTIN, START, JOIN, AGREE), Xagle automatically records consent with method sms_opt_in, stamps the consent timestamp, and unblocks outbound SMS to that client. If the client replies with a STOP-family keyword (STOP, UNSUBSCRIBE, CANCEL, END, QUIT, OPTOUT, REVOKE, STOPALL), the request is recorded as declined and no outbound SMS is permitted. No reply within the 30-day window means the consent state remains unchanged.

Method 2 — Verbal (spoken consent during meeting or service call)

During a meeting or phone call with their client, the Business User reads the following standardized script aloud:

"Before I add you to our system, I want to let you know that we'll send you transactional text messages — things like invoice notifications, appointment reminders, and quote updates. Message and data rates may apply. You can reply STOP at any time to stop receiving messages, or HELP for help. Is that okay with you?"

This script is presented in the Xagle UI on the client edit screen via the Show verbal consent script link, immediately adjacent to the consent checkbox, so the Business User reads the exact wording at the moment of attestation. After the client agrees verbally, the Business User checks the consent box and selects Verbal (spoken) as the consent method. Xagle stamps the consent timestamp and records method verbal on the client record. The action is logged to the per-client timeline with the user's ID and the timestamp for audit.

Method 3 — Recipient-initiated SMS (TCPA)

When a client sends an inbound SMS to the Business User's dedicated Xagle number first, that inbound message constitutes opt-in under TCPA. Xagle records this automatically: the inbound is timestamped to the client record, the consent box is set, the method is recorded as inbound, and the originating phone number is captured. No manual attestation is required.

Opt-out: STOP at any time

Every outbound message includes "Reply STOP to unsubscribe." Twilio's Messaging Service handles STOP and HELP keyword auto-responses at the carrier layer. Xagle mirrors the opt-out into its own consent record: a STOP-family inbound clears the consent flag immediately, so the outbound block re-engages. A client may resubscribe by replying START to the Business User's number, or by completing any of the three opt-in methods above again.

Xagle's SMS consent gate operates only on the SMS send path. Business Users can create invoices, schedule appointments, generate quotes, and use every other feature of Xagle for a client regardless of that client's SMS consent state. Consent is required only to send the client an SMS; no other workflow is blocked.

Audit and enforcement

Every consent state change emits a timeline event on the affected client record (sms_consent_granted, sms_consent_revoked, or sms_opt_in_requested), including the method used and the user ID of the Business User who attested or the inbound that triggered it. Outbound SMS attempts against a client without consent are also logged (sms_send_blocked_no_consent) and the message is failed at the platform layer before any carrier traffic is generated.

Back to top