Acceptable Use Policy

Status of this policy

This policy applies to every use of Pleezpay software, hosted payment flows, APIs, dashboards and advisory services, whether by a customer, its staff, its contractors or anyone it allows to act through its account. It is incorporated by reference into the signed agreement between Pleezpay and the customer and applies together with the General Terms, the Privacy Notice and the Legal Notice.

Pleezpay is not a bank. Payments are processed by connected, independently regulated payment providers, and card payments are also governed by the operating rules of the card networks. Each connected provider applies its own acceptable use rules to traffic that reaches it through Pleezpay, and each card network applies its own rules to card traffic. Those rules apply in addition to this policy. Where a provider rule or a card network rule is stricter than this policy, the stricter rule prevails for the traffic it governs.

1. Eligibility and onboarding

Production access is granted only after a know your business (KYB) review of the legal entity, its ownership and its business model. Before and during that review, and for as long as the account remains open, the customer must:

• Provide accurate and complete information about the legal entity, its directors, its beneficial owners, its sources of funds, its products, its markets and its compliance arrangements, and correct that information as soon as it changes.
• Use Pleezpay only for the products, services, markets, currencies, domains, storefronts, applications and business models that were disclosed during onboarding and approved in writing.
• Notify Pleezpay before adding or changing a product line, storefront, domain, application, target market, fulfilment model, pricing model or billing model, and wait for written confirmation before sending live traffic for it.
• Keep every storefront, application and payment descriptor consistent with the approved business. The trading name shown to shoppers, the descriptor that appears on their statements and the legal entity that holds the account must describe the same business.
• Hold, and keep current, every licence, registration, permit and provider approval that the law or a connected provider requires for the approved activity in each market served.

Pleezpay may decline an application, limit an account to particular payment methods, currencies, markets or volumes, or require additional information at any time. Connected providers make their own onboarding decisions and may decline or limit a customer that Pleezpay has approved.

2. Prohibited businesses and activities

Pleezpay does not provide services for the businesses and activities below, and connected providers do not process payments for them, whether they form the whole of a customer’s business or only part of it. The list is not exhaustive. Illegal activity of any kind is prohibited, and any category that a connected provider or a card network prohibits is prohibited under this policy as well.

• Illegal goods and services: anything that is illegal to sell, supply or buy in the jurisdiction of the seller, the buyer or the provider; stolen goods, including digital and virtual goods; goods, services or content that encourage, instruct or facilitate illegal activity; fraudulent or forged documents, identity documents, qualifications and official seals; devices or services designed to defeat telecommunications, access or security controls; trade in protected wildlife, endangered species, cultural property and human remains.
• Pharmaceuticals, drugs and controlled substances: prescription medicines, prescription devices and online pharmacies without the licences the law requires; peptides, research chemicals, nootropics, steroids and other compounds sold, marketed or labelled for human consumption or use without the licences the law requires, including products described as not for human use that are in practice sold for it; controlled substances, illegal drugs and substances designed to mimic them; cannabis products above the legal THC limit of the market served; drug paraphernalia and manufacturing or cultivation equipment marketed for illegal drug use; supplements that make unapproved medical or disease claims.
• Weapons, ammunition and dangerous materials: firearms, ammunition, firearm parts and accessories where their sale is illegal or unlicensed; explosives, fireworks and pyrotechnics without licence; weapons and knives regulated under applicable law; toxic, flammable, radioactive and other hazardous materials; military goods and dual use goods subject to export control, sold without authorisation.
• Adult content and services: pornography, including material generated by artificial intelligence; escort, prostitution and sexually oriented massage services; adult webcam, chat and streaming services; strip clubs; any sexual content involving minors, coercion, non consensual acts or animals, which Pleezpay also reports to the authorities.
• Gambling, lotteries and prize games: casino games, poker, bingo, lotteries, raffles, sweepstakes with a stake, sports and event betting, fantasy sports with entry fees, binary options and skill games played for money, unless the operator holds the licence required in every jurisdiction where it operates and where its customers are located, and the activity has been approved under section 3.
• Get rich quick and multi level marketing: pyramid, Ponzi and matrix schemes; multi level marketing and network marketing; investment or business opportunities that promise high returns for little or no risk, work or capital; unregistered investment offerings; any earning system that depends on recruiting others.
• Counterfeit and intellectual property infringing goods: counterfeit, replica and unauthorised branded goods; unlicensed copies of software, media, designs and trademarks; services that promote or enable infringement; unlawful sale or disclosure of personal data.
• Hate, violence and terrorism: content, goods or services that promote hate, violence, discrimination or intolerance against a protected group; organisations that promote or engage in unlawful violence; financing or support of terrorism; glorification of criminal violence.
• Human trafficking and exploitation: human trafficking, forced labour and modern slavery in any part of a business or its supply chain; child exploitation and child sexual abuse material in any form; trade in human organs.
• Unlicensed money services and financial activity: money transmission, remittance, currency exchange, cheque cashing, money orders, prepaid cards and stored value, escrow, deposit taking, lending, payday loans, buy now pay later, crowdfunding, insurance, securities, foreign exchange and commodity trading, and crypto asset exchange, brokerage, custody, staking, mining or token issuance, in each case without the licence or registration the law requires; shell banks and any bank without a physical presence; entities with bearer shares anywhere in their ownership chain; pass through accounts and peer to peer transfer services; offshore banking arrangements designed to avoid regulation.
• Sanctions evasion: any business owned or controlled by, or acting for, a sanctioned person, entity, vessel or government; business in or with a comprehensively sanctioned country or region; trade in sanctioned goods; any structure designed to disguise a sanctions connection.
• Fraud and deceptive practices: fraud of any kind; phishing, malware, spyware, ransomware and hacking tools or services; fake reviews and testimonials; technical support scams; identity theft protection sold deceptively; credential stuffing and card testing; products or services identified by a government agency as having a high likelihood of being fraudulent; bribery and corruption; charging for goods before the seller controls or possesses them where the law prohibits it.
• Debt and credit services: credit repair, debt settlement, debt relief, debt negotiation and debt consolidation services; debt collection, bailiff and claims management services without the licence the law requires; bankruptcy and bail bond services.
• Other prohibited activity: sale of age restricted goods to minors; timeshares; tax evasion services; unauthorised government, embassy or benefit services; telemarketing and door to door sales models; anything else that a connected provider, a card network or Pleezpay determines poses an unacceptable legal, financial or reputational risk.

3. Restricted businesses requiring prior written approval

The businesses below are not prohibited but carry elevated legal, regulatory, reputational or chargeback risk. They may be served only with Pleezpay’s prior written approval and only through a connected provider that accepts the category. Approval depends on the provider that would process the traffic: a category that one provider accepts under enhanced due diligence may be refused by another, and the same business may be approved for some markets, currencies or payment methods and not others. Approval may be limited by volume, market or method, may carry additional conditions, and may be withdrawn if the risk profile changes, if the provider withdraws its acceptance or if the customer breaches this policy.

• Dietary supplements, vitamins and nutraceuticals, where they make no unapproved medical claims and comply with food and product safety law in each market served.
• CBD and hemp derived products, only where lawful in the market of the seller and the buyer and within local THC limits. Ingestible CBD is refused by several providers in the European Union.
• Tobacco, nicotine products, electronic cigarettes and vaping products, with age verification. Cigarettes are refused outright by some providers.
• Alcohol, with age verification and the licences the law requires.
• Telemedicine, telehealth, online consultations, prescription fulfilment, licensed online pharmacies, regulated medical devices and medical treatments.
• Dating, matchmaking and companionship services, and live streaming or chat platforms.
• Travel: airlines, charter operators, cruise lines, hotels and accommodation, tour operators, travel agencies and travel clubs. Some providers refuse scheduled airlines and cruise lines outright.
• Event ticketing and ticket resale.
• Subscriptions, memberships, free trial conversions, negative option billing and other recurring billing models.
• High value goods: jewellery, precious metals and stones, luxury goods, art, antiques, collectibles, auction houses and pawn services.
• Marketplaces, platforms, dropshipping and any model in which the customer collects funds for goods or services supplied by others.
• Charities, not for profit organisations, fundraising, crowdfunding, and political or religious organisations.
• Licensed financial products and services: lending, buy now pay later, investment advice, brokerage, insurance, money transfer, currency exchange, prepaid cards and stored value.
• Crypto asset businesses that hold the licences or registrations the law requires: exchanges, brokers, custodians, wallet providers and first party token or NFT sales.
• Firearms accessories, optics, replica and airsoft products, and knives, where lawful, with age verification and no shipment to markets that restrict them.
• Licensed gambling, betting, lotteries and prize competitions, where the operator and its customers are located exclusively in jurisdictions that permit the activity. Some providers refuse gambling outright.
• File sharing and cyberlocker services, content creator platforms, digital downloads, virtual goods and currency used inside games, gift cards and vouchers.
• Businesses with a history of elevated chargeback, fraud or refund rates, or that were previously terminated by a provider or listed in a card network merchant termination file.
• Any other business that a connected provider classifies as restricted or high risk.

4. Financial crime, sanctions and money laundering

Pleezpay and its connected providers are subject to anti money laundering (AML), counter terrorist financing and sanctions obligations. The customer must not use Pleezpay, directly or through anyone else, to:

• Disguise the origin, ownership, destination or purpose of funds, or move funds through the platform in a way that has no legitimate commercial purpose.
• Structure activity: split amounts, stagger payments, route traffic or otherwise arrange transactions so that they stay under a reporting threshold, a monitoring threshold or a limit.
• Process payments on behalf of a third party that has not been disclosed to and approved by Pleezpay and the connected provider. This includes transaction laundering (presenting the sales of another business as the customer’s own), aggregation (collecting settlement proceeds for goods or services the customer does not itself supply), factoring, and any sharing, renting or lending of an account, credentials or descriptors.
• Split one business, or a group of businesses under common ownership or control, across multiple accounts, storefronts, descriptors, legal entities or providers in order to evade limits, monitoring thresholds, chargeback programmes, or a decline, restriction or termination decision made by Pleezpay or a provider. All related accounts and entities must be disclosed.
• Act for, on behalf of, or for the benefit of a person, entity, vessel, aircraft or government subject to sanctions administered by the United States (including the Office of Foreign Assets Control), the European Union, the United Kingdom, the United Nations or another authority whose sanctions apply to Pleezpay or a connected provider, including entities owned or controlled by such persons.
• Accept payments from, ship goods to or deliver services in a comprehensively sanctioned country or region, or process a transaction that would breach export control law.

The customer must keep its beneficial ownership and control information current and notify Pleezpay promptly of any change in ownership of 25 percent or more, in control, in directors or in the legal entity itself. It must respond to requests for information, documents, invoices, proof of delivery, licences and explanations of transactions within the time stated in the request, and must carry out its own customer due diligence and sanctions screening where the law requires it. Pleezpay and connected providers may hold affected transactions or settlement until a request has been answered.

5. Card network and provider compliance

Card payments are subject to the operating rules of the card networks and to the rules of the connected provider that processes them. The customer must:

• Descriptors: use only the descriptors approved during onboarding. A descriptor must identify the business the shopper dealt with and include a reachable contact, and must not be misleading.
• URLs and storefronts: disclose every website, application, sales channel and storefront that sends traffic to Pleezpay, and keep them consistent with the approved business. Undisclosed mirror sites, redirect sites and cloaked pages are prohibited.
• No load balancing: not distribute transactions across multiple accounts, providers, descriptors or merchant accounts in order to manage chargeback or fraud ratios or to evade monitoring. Routing between connected providers is performed by Pleezpay under the approvals those providers have given to Pleezpay; it does not license a customer to do the same.
• Chargeback and fraud ratios: keep fraud reports and disputes below the levels at which card network monitoring programmes and connected providers act. As an indication, the card networks currently treat a monthly fraud and dispute ratio at or around 1.5 percent of settled card not present transactions as excessive, and act earlier on accounts that show sudden volume growth or card testing. Connected providers and Pleezpay may set lower limits for a specific account and may require a remediation plan, method restrictions or reserves.
• Authentication: apply 3D Secure or other strong customer authentication where the law, the card networks or the connected provider requires it, and not disable or bypass it. Card details may be collected only through hosted payment flows or secure fields provided or approved by Pleezpay.
• Refunds and disputes: refund to the original payment method, respond to retrieval requests and disputes by the stated deadline with accurate evidence, and not use refunds, credits or reversals to move value between parties.
• Surcharging and currency: apply surcharges only where and in the way the law and the card networks permit, disclose them before the shopper pays, present any currency conversion with the disclosures and shopper choice the network rules require, and never misrepresent the transaction currency or the country of the transaction.
• Accurate merchant category and transaction type: operate under the merchant category, transaction country and business description assigned during onboarding, and not misdescribe goods, the transaction type (for example presenting a subscription as a single purchase or a purchase as a donation) or the physical location of the business.

6. Consumer protection and marketing

Shoppers must be able to understand what they are buying, what it costs and how to get help. In every market served, the customer must:

• Show the total price, including taxes, fees and delivery charges, and the currency of the charge before the shopper commits to pay.
• Publish on each storefront its legal identity and contact details, delivery times and shipping terms, refund, return and cancellation terms, and the contact for disputes.
• Obtain express consent for recurring billing after clearly disclosing the amount, frequency, trial terms and the date of the first full charge, confirm the terms to the shopper in writing, provide an online cancellation method that is at least as easy as signing up, and send the reminders that the law or the card networks require before a trial converts or a plan renews.
• Make no misleading claims about results, safety, efficacy, origin, endorsements, availability or scarcity, and no unapproved health, medical, disease or therapeutic claims, and not use fake reviews or testimonials.
• Deliver what was sold within the stated time, keep proof of delivery, and charge only when the law and the card networks permit.
• Send marketing messages only with the consent the law requires, honour unsubscribe requests, and not send spam.
• Comply with consumer protection, distance selling, product safety, age verification, tax (including registration and collection of VAT, GST and sales tax) and data protection law in each market served.

7. Platform and security integrity

• Credentials: keep API keys, signing secrets and login credentials confidential, give each user an individual login, apply role based access, enable multi factor authentication where offered, and revoke access when staff or contractors leave.
• Secret keys: never place secret keys or signing secrets in browser code, mobile applications, public repositories, logs or any other location accessible to third parties. Only keys documented as publishable may be used on the client side.
• No probing or bypassing: do not scan, test, fuzz or attempt to bypass access controls, rate limits, fraud controls, risk checks, authentication or velocity limits, and do not attempt to access data belonging to another customer. Good faith reporting of a suspected vulnerability is welcome under the Security & Trust page.
• Rate limits and automation: do not rotate credentials, addresses or accounts to exceed limits, generate abusive traffic or perform automated card testing. Storefronts must carry their own velocity and bot controls.
• No scraping or resale: do not scrape, reverse engineer, resell, sublicense or white label the service, its documentation or its data without a written agreement.
• Webhooks and payment evidence: verify the signature and timestamp of every webhook before acting on it, serve webhook endpoints over TLS, and treat server confirmed API or webhook states, not a browser return page, as payment evidence.
• Environments: keep sandbox and live credentials separate, never send real card data to the sandbox, and never send test data to live.
• Reporting compromise: report any suspected compromise of credentials, systems, storefronts or shopper data to [email protected] without delay, and cooperate with containment and investigation.

8. Data protection

The customer must process shopper data lawfully, give shoppers the privacy information the law requires, use the data only for the transaction and other lawful purposes, and honour data subject requests. It must not send full card numbers, security codes, bank credentials, passwords, government identifiers or other sensitive data through fields, metadata, descriptors, support channels, email, chat, webhooks or API parameters that are not designed for them. Card data may be collected only through hosted payment flows or secure fields provided or approved by Pleezpay; a customer that handles card data in its own environment is responsible for its own compliance scope, including PCI DSS. The Privacy Notice and any Data Processing Agreement in the signed agreement apply to personal data handled through the service.

9. Monitoring and enforcement

Pleezpay and connected providers monitor transactions, disputes, refunds, storefronts and account activity for compliance with this policy, including through automated review, content review of storefronts and test purchases. Where Pleezpay has reason to believe this policy has been or may be breached, it may, without prior notice where the situation requires it:

• Request information, documents or explanations, and review storefronts, applications and sales channels.
• Restrict payment methods, markets, currencies, volumes or features, or hold particular transactions pending review.
• Suspend or terminate access to some or all of the service.
• Where a signed agreement or a connected provider requires or permits it, delay or withhold settlement, or apply reserves, pending review.
• Require a remediation plan and evidence that it has been carried out before restoring service.

Connected providers may take their own action under their own terms, including holds, reserves, chargeback fees, fines, termination and reporting, and Pleezpay cannot override those decisions. Pleezpay may report activity to connected providers, card networks and public authorities where the law or an agreement requires it, and may share information with connected providers to assess risk. Enforcement does not waive any other remedy. The customer remains responsible, as set out in the signed agreement, for fines, assessments and losses caused by its breach.

10. Reporting a violation

Anyone may report a suspected breach of this policy to [email protected] with “Acceptable use report” in the subject. Include the storefront, account or payment reference concerned, what you observed, when, and any evidence you can safely share. Reports are reviewed by Pleezpay and, where relevant, forwarded to the connected provider. We may not be able to confirm the outcome of a review to the person who reported it.

11. Changes to this policy

This policy is updated as risks, laws, card network rules and connected provider requirements change. Material changes are notified to customers through the dashboard or by email with reasonable notice, except where a legal or provider requirement means a change must take effect immediately. The date at the top of this page identifies the current version. Continued use of the service after a change takes effect constitutes acceptance of the updated policy.