Acceptable use policy

How this policy fits with your agreement

In this policy, “you” means the business that holds a Pleezpay account. The policy covers everything you do with our dashboards, APIs, software, hosted payment flows and advisory services, and it covers your staff, your contractors and anyone else you let act through your account. It is part of your signed agreement with Pleezpay, and it sits alongside the Privacy notice, the Legal notice and the General terms.

We are not a bank. The payments themselves go through connected providers, each regulated in its own right, and card payments also fall under the card networks’ operating rules. Every provider applies acceptable use rules of its own to the traffic we send it, and the card networks do the same for card traffic. You follow those rules as well as this policy. If one of them is stricter than what is written here, the stricter rule governs that traffic.

What we need from you, before go-live and after

No account goes live until our KYB (know-your-business) review is complete. It looks at the legal entity, the people who own it and how it makes money, and it is not a one-off: from the day you apply until the day the account closes, the points below hold.

• Your information is accurate and complete — the legal entity, its directors and beneficial owners, where your funds come from, what you sell, where you sell it and how you handle compliance — and you update it as soon as any of it changes.
• You use Pleezpay only for what we approved in writing at onboarding: the storefronts, domains, applications, products, services, markets, currencies and business model you described to us.
• Before you add or change a storefront, domain, application, product line or target market, or change your pricing, billing or fulfilment model, you tell us. You send no live traffic for it until we confirm in writing.
• The name shoppers see on your storefront or application, the descriptor on their bank statement and the account holder’s legal entity all describe one and the same business, and every storefront, application and descriptor matches what we approved.
• Every permit, licence, registration and provider approval needed in each of your markets for the activity we approved — whether it is required by law or by a connected provider — is in place and kept current.

At any time we may turn down an application, ask for more information, or restrict which methods, currencies or markets an account may use and how much volume it may process. Providers decide on onboarding independently of us, so a provider may still turn away or limit a business we have approved.

Allowed only with our written approval

Nothing in this section is banned outright, but each business here carries more chargeback, legal, regulatory or reputational risk than usual. We serve these businesses only once we have approved them in writing, and their traffic goes only to a connected provider willing to take the category.

Whether we can approve depends on which provider would carry the traffic. One provider may accept a category after enhanced due diligence where another turns it down, and a single business may get approval for some methods, markets or currencies but not for others. An approval can be capped by volume, market or method and can come with extra conditions. We can withdraw it if your risk profile shifts, if the provider no longer accepts the category, or if you breach this policy.

Health, wellbeing and age-restricted goods

• Vitamins, dietary supplements and nutraceuticals, provided they carry no unapproved medical claims and meet the food safety and product safety rules of each market where they are sold.
• Hemp-derived and CBD products, where both the seller’s and the buyer’s markets allow them and inside local THC limits. In the European Union, several providers refuse ingestible CBD.
• Tobacco and nicotine products, e-cigarettes and vapes, with age verification in place. Some providers turn cigarettes away entirely.
• Alcohol, with age verification and every licence the law calls for.
• Online consultations, telehealth and telemedicine, prescription fulfilment and licensed online pharmacies, medical treatments and regulated medical devices.

Travel, tickets, dating and recurring billing

• Companionship, dating and matchmaking services, and platforms for live streaming or chat.
• Travel businesses: hotels and other accommodation, airlines, charter operators and cruise lines, tour operators, and travel clubs and agencies. Some providers turn down cruise lines and scheduled airlines entirely.
• Selling tickets to events, resale included.
• Recurring billing in any form: memberships, subscriptions, free trials that convert to paid plans, negative-option billing and similar models.

High-value goods, money and collecting for others

• High-value goods such as jewellery, precious stones and metals, art, antiques, collectibles and other luxury goods, plus pawnbrokers and auction houses.
• Dropshipping, marketplaces, platforms and any other model where you collect money for goods or services someone else supplies.
• Charities and not-for-profit organisations, crowdfunding and fundraising, and religious or political organisations.
• Financial products and services you are licensed to offer: lending, buy now pay later, brokerage, investment advice, insurance, currency exchange, money transfer, stored value and prepaid cards.
• Crypto asset businesses that are licensed or registered as the law requires — custodians, exchanges, brokers and wallet providers — and first-party sales of NFTs or tokens.

Weapon accessories, gambling and digital goods

• Where lawful: knives, optics, airsoft and replica products, and firearms accessories — with age verification, and never shipped to a market that restricts them.
• Betting, gambling, prize competitions and lotteries that are licensed, provided the operator and all of its customers are in jurisdictions that allow it. Some providers turn gambling away entirely.
• Digital goods and services: digital downloads, in-game currency and other virtual goods, content creator platforms, cyberlockers and file sharing, and vouchers and gift cards.

Risk history and provider classification

• Businesses with a past record of high fraud, refund or chargeback rates, or that a provider has terminated before, or that a card network has placed on its merchant termination file.
• Anything a connected provider classifies as high risk or restricted.

Businesses we never take on

We can’t offer our services to anything in the groups below, and no connected provider will process its payments — whether it is your whole business or a single product line. These groups are examples, not a complete list: anything illegal is excluded, and so is any category a card network or a connected provider excludes.

Crime, deception and fake goods

• Goods and services that it is illegal to buy, sell or supply where the provider, the seller or the buyer is, and stolen goods, digital and virtual ones included.
• Anything — goods, services or content — that encourages, teaches or helps people break the law; forged or fraudulent official seals, qualifications, identity documents and other documents; and devices or services built to get past security, access or telecommunications controls.
• Trading in human remains, cultural property, endangered species or protected wildlife.
• Counterfeits, replicas and branded goods sold without the brand owner’s authorisation; unlicensed copies of trademarks, designs, media and software; services that enable or promote infringement; and selling or disclosing personal data unlawfully.
• Fraud in any form, including ransomware, malware, spyware, phishing and hacking tools or services; testimonials and reviews that are fake; scams posing as technical support; deceptively sold identity theft protection; card testing and credential stuffing; any product or service a government agency has flagged as highly likely to be fraudulent; bribery and corruption; and, where the law forbids it, taking payment for goods the seller does not yet control or hold.
• Tax evasion services, and unauthorised services relating to government, embassies or benefits.

Drugs, health claims and dangerous goods

• Unlicensed online pharmacies, prescription devices and prescription medicines.
• Steroids, nootropics, research chemicals, peptides and other compounds that are marketed, labelled or sold for people to consume or use, unless licensed as the law requires. That includes anything labelled “not for human use” that is, in practice, sold for exactly that.
• Illegal drugs, controlled substances and look-alike substances designed to imitate them; cannabis products whose THC content is over the legal limit where they are sold; drug paraphernalia, and equipment for making or growing drugs that is marketed for illegal use; and supplements carrying medical or disease claims that have not been approved.
• Firearms, their parts and accessories, and ammunition, anywhere selling them is illegal or unlicensed; fireworks, pyrotechnics and explosives sold without a licence; knives and other weapons that the applicable law regulates; hazardous materials, whether toxic, flammable, radioactive or otherwise dangerous; and export-controlled military or dual-use goods sold without authorisation.

Adult content, gambling and harm to people

• Pornography, AI-generated material included; escort services, prostitution, and massage services of a sexual nature; adult services delivered by webcam, chat or live stream; and strip clubs.
• Sexual content of any kind that involves minors, animals, coercion or non-consensual acts. We also report it to the authorities.
• Gambling for money — poker, bingo, casino games, lotteries and raffles, sweepstakes that require a stake, betting on sports or events, fantasy sports with an entry fee, skill games and binary options — unless the operator is licensed in each jurisdiction it operates in and each jurisdiction its customers are in, and we have approved the activity under the section above.
• Goods, services or content promoting discrimination, intolerance, hate or violence towards a protected group; groups that promote or commit unlawful violence; funding or supporting terrorism; and glorifying criminal violence.
• Forced labour, human trafficking or modern slavery anywhere in a company’s operations or supply chain; child sexual abuse material and child exploitation of any kind; and buying or selling human organs.

Money, credit and sanctions

• Any of these, unless licensed or registered as the law requires: money orders, cheque cashing, currency exchange, remittance or money transmission, escrow, taking deposits, stored value and prepaid cards, insurance, securities, crowdfunding, buy now pay later, lending and payday loans, commodity or foreign exchange trading, and exchanging, brokering, holding in custody, staking or mining crypto assets, or issuing tokens.
• Banks with no physical presence and shell banks; any entity whose ownership chain includes bearer shares at any level; peer-to-peer transfer services and pass-through accounts; and offshore banking set up to avoid regulation.
• Matrix, Ponzi and pyramid schemes; network or multi-level marketing; business or investment opportunities promising high returns in exchange for little or nothing in risk, work or capital; investment offerings that are unregistered; and any way of earning that relies on recruiting other people.
• Credit repair, and debt settlement, relief, negotiation or consolidation services; debt collection, claims management and bailiff work carried on without the required licence; and bail bonds and bankruptcy services.
• Any business acting for, owned by or controlled by a sanctioned government, person, entity or vessel; business in or with a country or region under comprehensive sanctions; trading sanctioned goods; and any structure built to hide a link to sanctions.

Anything else

• Timeshares; selling age-restricted goods to minors; and door-to-door or telemarketing sales models.
• Any other activity that Pleezpay, a card network or a connected provider decides carries an unacceptable risk, whether legal, financial or reputational.

Money laundering, sanctions and financial crime

We and our connected providers have sanctions, anti-money-laundering (AML) and counter-terrorist-financing obligations. You must not use Pleezpay — yourself or through anyone else — for any of the following.

• Hiding the purpose, destination, ownership or source of funds, or moving money through the platform without a genuine commercial reason.
• Structuring: splitting amounts, spacing out payments, steering traffic or arranging payments in any other way to stay under a limit or a reporting or monitoring threshold.
• Taking payments for a third party that neither we nor the connected provider have been told about and approved. That covers transaction laundering (passing off another business’s sales as yours), aggregation (taking in settlement proceeds for services or goods that you don’t supply yourself), factoring, and lending, renting or sharing an account, credentials or descriptors.
• Spreading a single business, or several businesses with common owners or control, across multiple providers, legal entities, accounts, storefronts or descriptors to evade chargeback programmes, monitoring thresholds or limits, or to get around a decision by us or a provider to decline, restrict or terminate. You must disclose every related account and entity.
• Acting for, on behalf of or to benefit any government, person, entity, vessel or aircraft under United Nations, European Union, United Kingdom or United States sanctions (those of the US Office of Foreign Assets Control included), or under the sanctions of any other authority that bind us or a connected provider — and that includes entities such persons own or control.
• Taking payments from, shipping goods to or providing services in a country or region under comprehensive sanctions, or processing any payment that would break export control law.

Keep us current on who owns and controls your business. Tell us promptly if at least 25 percent of the ownership changes hands, if control changes, if directors change or if the legal entity itself changes. When we ask for licences, invoices, proof of delivery, documents, information or an explanation of payments, reply within the time the request gives. Where the law requires it, run your own sanctions screening and customer due diligence. Until a request is answered, the payments or settlement it concerns may be held by us or by connected providers.

Treating your shoppers fairly

A shopper should always know what the purchase is, the full cost and where to go for help. In each market you serve:

• Before the shopper commits, show the full price — taxes, fees and delivery included — and the currency you will charge in.
• On every storefront, publish who you are legally and how to reach you, how and when you ship, your cancellation, refund and returns terms, and a contact for disputes.
• For recurring billing, clearly show the amount, how often it is charged, any trial terms and when the first full charge falls, then get the shopper’s express consent. Confirm the terms to them in writing, let them cancel online at least as easily as they signed up, and send every reminder that card network rules or the law require ahead of a trial turning into a paid plan or a plan renewing.
• Don’t make misleading claims about efficacy, safety, results, origin, availability, scarcity or endorsements, don’t make therapeutic, medical, health or disease claims that are not approved, and don’t rely on fake testimonials or reviews.
• Deliver what you sold in the time you stated and keep proof that it arrived. Take payment only at a point the law and card network rules allow.
• Send marketing only to people who have given the consent required by law, act on every unsubscribe request, and never send spam.
• Follow the law in every market you serve on data protection, distance selling, consumer protection, age verification, product safety and tax — including registering for and collecting sales tax, GST and VAT.

Rules for card payments

Card payments are governed both by the card networks’ operating rules and by the rules of whichever connected provider processes them. For card traffic, that means:

• Use your approved descriptors. Only descriptors approved at onboarding. Each must name the business the shopper actually dealt with, carry a contact that reaches someone, and never mislead.
• Declare every storefront. Tell us about every storefront, sales channel, application and website sending traffic our way, and keep each one in line with the approved business. Cloaked pages, redirect sites and mirror sites you haven’t disclosed are prohibited.
• Don’t load-balance. Never spread payments across merchant accounts, descriptors, providers or accounts to manage fraud or chargeback ratios or to stay under monitoring. We route between connected providers under approvals those providers gave us; that gives you no licence to do the same yourself.
• Keep disputes and fraud low. Keep disputes and fraud reports under the point where connected providers and card network monitoring programmes take action. For guidance, the card networks currently regard fraud and disputes reaching roughly 1.5 percent of a month’s settled card-not-present payments as excessive, and they move sooner on accounts showing card testing or a sudden jump in volume. We and connected providers may set a lower limit for your account, and may require reserves, method restrictions or a remediation plan.
• Authenticate. Use 3-D Secure or another form of strong customer authentication wherever the law, any card network or the connected provider calls for it, and never turn it off or route around it. Take card details only via secure fields or hosted payment flows that we supply or approve.
• Handle refunds and disputes properly. Refund to the method the shopper originally paid with, answer disputes and retrieval requests with accurate evidence before the deadline, and never use a refund, credit or reversal to shift value from one party to another.
• Be upfront about surcharges and currency. Surcharge only in the cases and the manner that card network rules and the law permit, and show the surcharge before the shopper pays. If you offer currency conversion, give the shopper the choice and the disclosures that network rules require. Never misrepresent which currency or country a payment is in.
• Describe your business truthfully. Trade under the business description, transaction country and merchant category we assigned at onboarding. Don’t misdescribe what you sell, the type of payment (for instance, a subscription passed off as a one-time purchase, or a purchase passed off as a donation) or where the business is physically based.

Keys, access and integration security

• Access. Keep login credentials, API keys and signing secrets confidential. Give every user their own login, set access by role, switch on multi-factor authentication wherever it is offered, and take access away from staff or contractors who leave.
• Where secrets live. Secret keys and signing secrets never go into browser code, mobile apps, logs, public code repositories or anywhere a third party could reach them. In client-side code, use only keys our documentation marks as publishable.
• Testing our controls. Don’t scan, fuzz, test or try to get around authentication, access controls, rate limits, velocity limits, risk checks or fraud controls, and don’t try to get at another customer’s data. If you think you have found a vulnerability, we welcome a good-faith report, made as the Security page describes.
• Traffic and automation. Don’t cycle through accounts, addresses or credentials to get past limits, don’t generate abusive traffic, and don’t run automated card testing. Your storefronts need bot and velocity controls of their own.
• Reuse of the service. Unless we have agreed it in writing, don’t resell, sublicense, white-label, scrape or reverse engineer the service, its data or its documentation.
• Proof of payment. Before acting on a webhook, check its timestamp and signature. Webhook endpoints must use TLS. Count a payment as made only when our server confirms it through the API or a webhook, never because a shopper landed on a return page in their browser.
• Test and live. Keep test credentials apart from live ones. Real card data never goes into the test environment, and test data never goes into live.
• If something is compromised. Tell us straight away at [email protected] if you suspect shopper data, storefronts, systems or credentials have been compromised, and work with us to contain and investigate it.

Handling shopper and card data

The shopper data you handle is your responsibility. In particular:

• Handle it lawfully, provide shoppers with the legally required privacy information, use it for the payment and other lawful purposes only, and act on data subject requests.
• Never send government identifiers, passwords, full card numbers, bank credentials, security codes or any other sensitive data via a channel that wasn’t built for it — email, chat, support channels, API parameters, webhooks, metadata, descriptors or fields.
• Collect card data only via secure fields or hosted payment flows we supply or approve. If you handle card data in your own environment, your own compliance scope, PCI DSS included, is yours to manage.

Personal data that passes through the service is also covered by our Privacy notice and by any Data Processing Agreement that forms part of your signed agreement.

How we monitor, and what we can do

We and our connected providers watch account activity, storefronts, refunds, disputes and payments to check that this policy is followed. That includes automated review, reviewing storefront content and making test purchases.

If we have reason to believe you have breached this policy, or may do so, we can take any of these steps — without notice when the situation calls for it:

• ask you to explain, or to send documents or information, and review your sales channels, applications and storefronts;
• limit features, volumes, currencies, markets or methods, or hold particular payments while we review them;
• suspend or end your access to part or all of the service;
• apply reserves, or hold back or delay settlement, during the review, if a connected provider or a signed agreement allows or requires this;
• require a remediation plan, and proof that you have carried it out, before we restore service.

Providers can also act under their own terms — reporting, termination, fines, chargeback fees, reserves and holds among them — and we have no power to overrule them. When an agreement or the law requires it, we may report activity to public authorities, card networks and connected providers, and we may give connected providers information so they can assess risk. Using one of these steps leaves every other remedy open. As your signed agreement sets out, you remain responsible for losses, fines and assessments your breach causes.

Report a breach

Anyone can tell us about a suspected breach. Email [email protected] and put “Acceptable use report” as the subject line. Include:

• the payment, account or storefront reference;
• what you saw, and when;
• any evidence that is safe for you to share.

We look at every report and pass it to the connected provider where that is relevant. The outcome of a review is not always something we can share with the person who reported it.

When this policy changes

As laws, risks, provider requirements and card network rules change, so does this policy. For a material change we give customers reasonable notice in the dashboard or by email, unless a legal or provider requirement forces the change to apply immediately. The date shown above marks the current version, and continuing to use the service once a change takes effect means you accept it.