Acceptable use policy

Who this policy applies to

This policy covers every use of Pleezpay software, hosted payment flows, APIs, dashboards and advisory services, by a customer, its staff, its contractors or anyone it lets act through its account. It forms part of the signed agreement between Pleezpay and the customer, and applies together with the General terms, the Privacy notice and the Legal notice.

Pleezpay is not a bank. Connected payment providers, each independently regulated, process the payments, and the card networks’ operating rules also govern card payments. Each connected provider applies its own acceptable use rules to the traffic that reaches it through Pleezpay, and each card network applies its own rules to card traffic. Those rules apply on top of this policy. Where a provider or card network rule is stricter than this policy, the stricter rule wins for the traffic it governs.

Eligibility and onboarding

We grant live access only after a know-your-business (KYB) review of the legal entity, its owners and its business model. Before and during that review, and for as long as the account is open, the customer must:

• Give accurate and complete information about the legal entity, its directors, its beneficial owners, its sources of funds, its products, its markets and its compliance arrangements, and correct it as soon as anything changes.
• Use Pleezpay only for the products, services, markets, currencies, domains, storefronts, applications and business models it disclosed during onboarding and we approved in writing.
• Tell us before adding or changing a product line, storefront, domain, application, target market, fulfilment model, pricing model or billing model, and wait for our written confirmation before sending live traffic for it.
• Keep every storefront, application and payment descriptor consistent with the approved business. The trading name shoppers see, the descriptor on their statements and the legal entity that holds the account must all describe the same business.
• Hold, and keep current, every licence, registration, permit and provider approval that the law or a connected provider requires for the approved activity in each market it serves.

We may decline an application, limit an account to certain payment methods, currencies, markets or volumes, or ask for more information at any time. Connected providers make their own onboarding decisions and may decline or limit a customer we have approved.

Prohibited businesses and activities

We don’t provide services for the businesses and activities below, and connected providers don’t process payments for them, whether they are the whole of a customer’s business or only part of it. The list is not complete. Any illegal activity is prohibited, and so is any category a connected provider or a card network prohibits.

• Illegal goods and services: anything illegal to sell, supply or buy where the seller, the buyer or the provider is; stolen goods, including digital and virtual goods; goods, services or content that encourage, teach or help illegal activity; fraudulent or forged documents, identity documents, qualifications and official seals; devices or services built to defeat telecommunications, access or security controls; trade in protected wildlife, endangered species, cultural property and human remains.
• Pharmaceuticals, drugs and controlled substances: prescription medicines, prescription devices and online pharmacies without the licences the law requires; peptides, research chemicals, nootropics, steroids and other compounds sold, marketed or labelled for human consumption or use without the licences the law requires, including products labelled “not for human use” that are in practice sold for it; controlled substances, illegal drugs and substances designed to imitate them; cannabis products above the legal THC limit of the market served; drug paraphernalia and manufacturing or cultivation equipment marketed for illegal drug use; supplements that make unapproved medical or disease claims.
• Weapons, ammunition and dangerous materials: firearms, ammunition, firearm parts and accessories where selling them is illegal or unlicensed; explosives, fireworks and pyrotechnics without a licence; weapons and knives regulated by the applicable law; toxic, flammable, radioactive and other hazardous materials; military and dual-use goods under export control, sold without authorisation.
• Adult content and services: pornography, including material generated by artificial intelligence; escort, prostitution and sexually oriented massage services; adult webcam, chat and streaming services; strip clubs; any sexual content involving minors, coercion, non-consensual acts or animals, which Pleezpay also reports to the authorities.
• Gambling, lotteries and prize games: casino games, poker, bingo, lotteries, raffles, sweepstakes with a stake, sports and event betting, fantasy sports with entry fees, binary options and skill games played for money — unless the operator holds the licence required in every jurisdiction where it operates and where its customers are, and the activity has been approved under the restricted businesses section below.
• Get-rich-quick schemes and multi-level marketing: pyramid, Ponzi and matrix schemes; multi-level and network marketing; investment or business opportunities that promise high returns for little or no risk, work or capital; unregistered investment offerings; any earning system that depends on recruiting others.
• Counterfeit goods and intellectual property infringement: counterfeit, replica and unauthorised branded goods; unlicensed copies of software, media, designs and trademarks; services that promote or enable infringement; unlawful sale or disclosure of personal data.
• Hate, violence and terrorism: content, goods or services that promote hate, violence, discrimination or intolerance against a protected group; organisations that promote or engage in unlawful violence; financing or supporting terrorism; glorifying criminal violence.
• Human trafficking and exploitation: human trafficking, forced labour and modern slavery anywhere in a business or its supply chain; child exploitation and child sexual abuse material in any form; trade in human organs.
• Unlicensed money services and financial activity: money transmission, remittance, currency exchange, cheque cashing, money orders, prepaid cards and stored value, escrow, deposit taking, lending, payday loans, buy now pay later, crowdfunding, insurance, securities, foreign exchange and commodity trading, and crypto asset exchange, brokerage, custody, staking, mining or token issuance — each without the licence or registration the law requires; shell banks and any bank without a physical presence; entities with bearer shares anywhere in their ownership chain; pass-through accounts and peer-to-peer transfer services; offshore banking arrangements designed to avoid regulation.
• Sanctions evasion: any business owned or controlled by, or acting for, a sanctioned person, entity, vessel or government; business in or with a comprehensively sanctioned country or region; trade in sanctioned goods; any structure designed to hide a sanctions connection.
• Fraud and deceptive practices: fraud of any kind; phishing, malware, spyware, ransomware and hacking tools or services; fake reviews and testimonials; technical support scams; identity theft protection sold deceptively; credential stuffing and card testing; products or services a government agency has identified as highly likely to be fraudulent; bribery and corruption; charging for goods before the seller controls or holds them, where the law prohibits it.
• Debt and credit services: credit repair, debt settlement, debt relief, debt negotiation and debt consolidation services; debt collection, bailiff and claims management services without the licence the law requires; bankruptcy and bail bond services.
• Other prohibited activity: selling age-restricted goods to minors; timeshares; tax evasion services; unauthorised government, embassy or benefit services; telemarketing and door-to-door sales models; anything else a connected provider, a card network or Pleezpay decides poses an unacceptable legal, financial or reputational risk.

Restricted businesses that need written approval first

The businesses below are not prohibited, but they carry higher legal, regulatory, reputational or chargeback risk. We can serve them only with our prior written approval, and only through a connected provider that accepts the category. Approval depends on the provider that would process the traffic: one provider may accept a category under enhanced due diligence while another refuses it, and the same business may be approved for some markets, currencies or payment methods and not others. Approval may be limited by volume, market or method, may come with extra conditions, and may be withdrawn if the risk profile changes, if the provider stops accepting the category, or if the customer breaches this policy.

• Dietary supplements, vitamins and nutraceuticals that make no unapproved medical claims and comply with food and product safety law in each market served.
• CBD and hemp-derived products, only where lawful in the seller’s and the buyer’s market and within local THC limits. Several providers in the European Union refuse ingestible CBD.
• Tobacco, nicotine products, electronic cigarettes and vaping products, with age verification. Some providers refuse cigarettes outright.
• Alcohol, with age verification and the licences the law requires.
• Telemedicine, telehealth, online consultations, prescription fulfilment, licensed online pharmacies, regulated medical devices and medical treatments.
• Dating, matchmaking and companionship services, and live streaming or chat platforms.
• Travel: airlines, charter operators, cruise lines, hotels and accommodation, tour operators, travel agencies and travel clubs. Some providers refuse scheduled airlines and cruise lines outright.
• Event ticketing and ticket resale.
• Subscriptions, memberships, free-trial conversions, negative-option billing and other recurring billing models.
• High-value goods: jewellery, precious metals and stones, luxury goods, art, antiques, collectibles, auction houses and pawn services.
• Marketplaces, platforms, dropshipping and any model where the customer collects funds for goods or services others supply.
• Charities, not-for-profit organisations, fundraising, crowdfunding, and political or religious organisations.
• Licensed financial products and services: lending, buy now pay later, investment advice, brokerage, insurance, money transfer, currency exchange, prepaid cards and stored value.
• Crypto asset businesses that hold the licences or registrations the law requires: exchanges, brokers, custodians, wallet providers and first-party token or NFT sales.
• Firearms accessories, optics, replica and airsoft products, and knives, where lawful, with age verification and no shipping to markets that restrict them.
• Licensed gambling, betting, lotteries and prize competitions, where the operator and its customers are only in jurisdictions that permit the activity. Some providers refuse gambling outright.
• File sharing and cyberlocker services, content creator platforms, digital downloads, virtual goods and in-game currency, gift cards and vouchers.
• Businesses with a history of high chargeback, fraud or refund rates, or that a provider has previously terminated or a card network has listed in its merchant termination file.
• Any other business a connected provider classifies as restricted or high risk.

Financial crime, sanctions and money laundering

Pleezpay and its connected providers have anti-money-laundering (AML), counter-terrorist-financing and sanctions obligations. The customer must not use Pleezpay, directly or through anyone else, to:

• Hide where funds come from, who owns them, where they go or what they are for, or move funds through the platform with no legitimate commercial purpose.
• Structure activity: split amounts, stagger payments, route traffic or otherwise arrange payments to stay under a reporting threshold, a monitoring threshold or a limit.
• Process payments for a third party that Pleezpay and the connected provider have not been told about and approved. This includes transaction laundering (presenting another business’s sales as the customer’s own), aggregation (collecting settlement proceeds for goods or services the customer does not supply itself), factoring, and sharing, renting or lending an account, credentials or descriptors.
• Split one business, or a group of businesses under common ownership or control, across several accounts, storefronts, descriptors, legal entities or providers to evade limits, monitoring thresholds, chargeback programmes, or a decision by Pleezpay or a provider to decline, restrict or terminate. All related accounts and entities must be disclosed.
• Act for, on behalf of or for the benefit of a person, entity, vessel, aircraft or government under sanctions administered by the United States (including the Office of Foreign Assets Control), the European Union, the United Kingdom, the United Nations, or any other authority whose sanctions apply to Pleezpay or a connected provider — including entities such persons own or control.
• Accept payments from, ship goods to or deliver services in a comprehensively sanctioned country or region, or process a payment that would breach export control law.

The customer must keep its beneficial ownership and control information current, and tell us promptly about any change in ownership of 25 percent or more, in control, in directors or in the legal entity itself. It must answer requests for information, documents, invoices, proof of delivery, licences and explanations of payments within the time the request states, and carry out its own customer due diligence and sanctions screening where the law requires it. Pleezpay and connected providers may hold the affected payments or settlement until a request is answered.

Card network and provider rules

The card networks’ operating rules and the rules of the connected provider that processes them govern card payments. The customer must follow these:

• Descriptors: use only the descriptors approved during onboarding. A descriptor must identify the business the shopper dealt with, include a contact that works, and not mislead.
• URLs and storefronts: disclose every website, application, sales channel and storefront that sends traffic to Pleezpay, and keep them consistent with the approved business. Undisclosed mirror sites, redirect sites and cloaked pages are prohibited.
• No load balancing: don’t spread payments across several accounts, providers, descriptors or merchant accounts to manage chargeback or fraud ratios or to evade monitoring. Pleezpay routes between connected providers under the approvals those providers have given Pleezpay. That does not license a customer to do the same.
• Chargeback and fraud ratios: keep fraud reports and disputes below the levels at which card network monitoring programmes and connected providers act. As a guide, the card networks currently treat a monthly fraud and dispute ratio at or around 1.5 percent of settled card-not-present payments as excessive, and act sooner on accounts with sudden volume growth or card testing. Connected providers and Pleezpay may set lower limits for a specific account, and may require a remediation plan, method restrictions or reserves.
• Authentication: apply 3-D Secure or other strong customer authentication where the law, the card networks or the connected provider requires it, and don’t switch it off or work around it. Collect card details only through hosted payment flows or secure fields that Pleezpay provides or approves.
• Refunds and disputes: refund to the original payment method, answer retrieval requests and disputes by the stated deadline with accurate evidence, and don’t use refunds, credits or reversals to move value between parties.
• Surcharges and currency: surcharge only where and how the law and the card networks allow, and show the surcharge before the shopper pays. Present any currency conversion with the disclosures and shopper choice the network rules require. Never misstate the payment currency or the country of the payment.
• Accurate merchant category and payment type: operate under the merchant category, payment country and business description assigned during onboarding. Don’t misdescribe the goods, the payment type (for example, presenting a subscription as a single purchase, or a purchase as a donation) or where the business physically is.

Consumer protection and marketing

Shoppers must be able to understand what they are buying, what it costs and how to get help. In every market it serves, the customer must:

• Show the total price, including taxes, fees and delivery charges, and the currency of the charge, before the shopper commits to pay.
• Publish on each storefront its legal identity and contact details, delivery times and shipping terms, refund, return and cancellation terms, and the contact for disputes.
• Get express consent for recurring billing after clearly showing the amount, frequency, trial terms and the date of the first full charge; confirm the terms to the shopper in writing; offer an online way to cancel that is at least as easy as signing up; and send the reminders the law or the card networks require before a trial converts or a plan renews.
• Make no misleading claims about results, safety, efficacy, origin, endorsements, availability or scarcity, and no unapproved health, medical, disease or therapeutic claims. Don’t use fake reviews or testimonials.
• Deliver what was sold within the stated time, keep proof of delivery, and charge only when the law and the card networks allow.
• Send marketing only with the consent the law requires, honour unsubscribe requests, and don’t send spam.
• Comply with consumer protection, distance selling, product safety, age verification, tax (including registering for and collecting VAT, GST and sales tax) and data protection law in each market served.

Platform and security integrity

• Credentials: keep API keys, signing secrets and login credentials confidential; give each user their own login; use role-based access; turn on multi-factor authentication where offered; and remove access when staff or contractors leave.
• Secret keys: never put secret keys or signing secrets in browser code, mobile applications, public repositories, logs or anywhere else third parties can reach. Only keys documented as publishable may be used on the client side.
• No probing or bypassing: don’t scan, test, fuzz or try to get around access controls, rate limits, fraud controls, risk checks, authentication or velocity limits, and don’t try to reach another customer’s data. We welcome good-faith reports of a suspected vulnerability, as described on the Security page.
• Rate limits and automation: don’t rotate credentials, addresses or accounts to exceed limits, generate abusive traffic or run automated card testing. Storefronts must have their own velocity and bot controls.
• No scraping or resale: don’t scrape, reverse engineer, resell, sublicense or white-label the service, its documentation or its data without a written agreement.
• Webhooks and payment evidence: verify the signature and timestamp of every webhook before acting on it, serve webhook endpoints over TLS, and treat states confirmed by our server through the API or a webhook — not a browser return page — as evidence of payment.
• Environments: keep test and live credentials separate, never send real card data to the test environment, and never send test data to live.
• Reporting compromise: report any suspected compromise of credentials, systems, storefronts or shopper data to [email protected] without delay, and help with containment and investigation.

Data protection

The customer must process shopper data lawfully, give shoppers the privacy information the law requires, use the data only for the payment and other lawful purposes, and honour data subject requests. It must not send full card numbers, security codes, bank credentials, passwords, government identifiers or other sensitive data through fields, metadata, descriptors, support channels, email, chat, webhooks or API parameters not designed for them. Card data may be collected only through hosted payment flows or secure fields that Pleezpay provides or approves. A customer that handles card data in its own environment is responsible for its own compliance scope, including PCI DSS. The Privacy notice and any Data Processing Agreement in the signed agreement apply to personal data handled through the service.

Monitoring and enforcement

Pleezpay and connected providers monitor payments, disputes, refunds, storefronts and account activity for compliance with this policy, including through automated review, content review of storefronts and test purchases. Where we have reason to believe this policy has been or may be breached, we may do any of the following, without notice where the situation calls for it:

• Ask for information, documents or explanations, and review storefronts, applications and sales channels.
• Restrict payment methods, markets, currencies, volumes or features, or hold particular payments for review.
• Suspend or end access to some or all of the service.
• Where a signed agreement or a connected provider requires or allows it, delay or withhold settlement, or apply reserves, while we review.
• Require a remediation plan, and evidence it has been carried out, before restoring service.

Connected providers may act under their own terms, including holds, reserves, chargeback fees, fines, termination and reporting, and Pleezpay cannot override those decisions. We may report activity to connected providers, card networks and public authorities where the law or an agreement requires it, and may share information with connected providers to assess risk. Enforcement does not waive any other remedy. As the signed agreement sets out, the customer remains responsible for fines, assessments and losses its breach causes.

Reporting a breach of this policy

Anyone can report a suspected breach of this policy to [email protected] with “Acceptable use report” in the subject. Include the storefront, account or payment reference, what you saw, when, and any evidence you can share safely. We review every report and, where relevant, pass it to the connected provider. We may not be able to tell the person who reported it what the review found.

Changes to this policy

We update this policy as risks, laws, card network rules and connected provider requirements change. We tell customers about material changes through the dashboard or by email, with reasonable notice, unless a legal or provider requirement means a change has to take effect immediately. The date at the top shows the current version. Using the service after a change takes effect means accepting the updated policy.