SMS Consent Flow

Last updated: May 29, 2026

For carrier and regulatory reviewers: This page exists to give carriers, The Campaign Registry (TCR), Twilio, and AWS End User Messaging reviewers a clear visual walkthrough of how OurWork captures SMS consent from message recipients. The actual in-app consent UI lives behind the Operator login at app.ourwork.tools, which is why we mirror it here as static mockups.

Who's who

OurWork is a software platform with two distinct user types. Understanding which is which is essential to understanding the consent flow.

Operators

Independent service-business owners (lawn care, landscaping, cleaning, etc.) who pay OurWork a monthly subscription to manage their business. They sign up on our website and have logins.

Recipients

The Operator's own end-customers — homeowners and businesses receiving the Operator's service. They do not have OurWork logins. They are the people who receive SMS messages.

Because Recipients don't have OurWork accounts, they do not sign up for SMS on a public web form. Instead, consent is captured through an Operator-initiated double opt-in: the Operator (who has an established business relationship with the Recipient) adds the Recipient's number, and OurWork sends a confirmation SMS that requires a YES reply before any further messaging.

Step 1 — Operator adds the Recipient and explicitly requests consent

When an Operator adds a Recipient to their account, the customer form includes a dedicated SMS consent section. The "Send SMS opt-in confirmation" checkbox is off by default. The Operator must affirmatively check it, and a phone number is required when they do.

app.ourwork.tools — New customer

Add customer

Jane Smith
jane@example.com
(555) 123-4567

Send SMS opt-in confirmation

By checking this box, I confirm that Jane Smith has authorized me to send them a one-time SMS asking them to confirm consent. After they reply YES, they will receive transactional SMS from Joe's Lawn Care about appointments, on-the-way alerts, job status, and invoices. Message frequency varies. Msg & data rates may apply. They can reply STOP to cancel or HELP for help at any time.

See our SMS Policy and Privacy Policy.

Save customer
Cancel

Mobile app version: same checkbox + disclosure text rendered with a native toggle switch.

Step 2 — Recipient receives a single double opt-in SMS

When the Operator saves the form, OurWork immediately sends exactly one SMS to the Recipient. This is the only message the Recipient receives prior to consent and contains all carrier-required elements: brand identity, message purpose, message frequency, "Msg & data rates may apply", and STOP/HELP keywords.

SMS — Today 2:14 PM
From: Joe's Lawn Care
Joe's Lawn Care: You're receiving this because Joe's Lawn Care added your number to their booking system. Reply YES to confirm and receive transactional SMS about appointments, jobs, and invoices. Msg frequency varies. Msg & data rates may apply. Reply STOP to cancel, HELP for help.

Step 3 — Recipient replies YES to grant consent

The Recipient must reply YES (also accepts AGREE, OK, CONFIRM, SUBSCRIBE). The reply itself is the legally meaningful consent artifact. OurWork records it as an immutable domain event in the Recipient's audit trail, capturing the phone number, timestamp, and the originating channel.

SMS — Today 2:15 PM
From: Joe's Lawn Care
Joe's Lawn Care: You're receiving this because... (see above)
YES
From: Joe's Lawn Care
You're confirmed. You'll receive SMS about your appointments and invoices. Reply STOP to unsubscribe.

If the Recipient does not reply YES, no further messages are sent — ever — until the Operator re-initiates the flow. There is no implicit consent path.

Step 4 — STOP and HELP are honored at two layers

A Recipient can reply STOP (also UNSUBSCRIBE, CANCEL, END, QUIT, STOPALL, OPTOUT) at any time. Two independent layers block future messages:

  1. The mobile carrier blocks all future SMS from the sender ID to that Recipient at the network layer.
  2. OurWork independently records the opt-out as a domain event and flips the Recipient's smsConsent flag to false, so any future Operator attempt to send to that number is blocked at the application layer.

Replying HELP returns support contact information (projectourwork@gmail.com) plus a reminder of how to opt out.

Audit trail

Every consent event is stored as an immutable, append-only domain event in the Recipient's record:

  • SmsConsentRequested — Operator initiated the double opt-in (records source: web_form or mobile_form, Operator account ID, timestamp)
  • SmsConsentGranted — Recipient replied YES (records the inbound message, phone number, timestamp)
  • SmsConsentRevoked — Recipient replied STOP, or Operator removed consent (records the trigger, timestamp)

These records are retained for the life of the account and are available for compliance review on request.

What we will never send

  • Marketing, promotional, or sales SMS of any kind
  • Political messaging
  • SMS to Recipients who have not personally replied YES
  • SMS to Recipients who have replied STOP without a fresh, out-of-band re-consent and a fresh double opt-in
  • Phone numbers shared, rented, or sold to third parties

Related documents