Acceptable Use & Prohibited Business Policy

This Policy applies to all merchant applications, websites, mobile applications, products and services, marketing campaigns, transactions, refunds, customer support workflows, affiliated accounts, and all activities processed through Cropay. Initial or formal onboarding approval does not waive ongoing compliance obligations; changes in business model, content, target regions, or ownership may trigger re-underwriting.

• Any activity violating applicable laws, court orders, sanctions regimes, card scheme rules, or mandatory partner institution requirements.

• Adult sexual services, child sexual exploitation and abuse material (CSAM), human trafficking, or non-consensual or exploitative content.

• Unlicensed gambling, lotteries, sports betting, casinos, money laundering, illegal payment aggregation ("factoring" / transaction laundering), cash-out schemes, or unauthorized fund bridging.

• Illicit drugs, controlled substances, weapons, ammunition, explosives, and other contraband goods.

• Fraud, identity theft, unauthorized transactions, deceptive charities, pyramid schemes, Ponzi schemes, or misleading investment solicitations.

• Malware, hacking, phishing, credential trafficking, circumvention of security controls, intellectual property infringement, or sale of counterfeit goods.

• Providing regulated financial, remittance, money changing, lending, securities, insurance, or virtual asset services without required licenses or registrations.

• Unauthorized cardholder charges, hidden pricing terms, pre-checked negative option billing, undisclosed automatic renewals, or deliberately obstructed cancellation flows.

Dating, matchmaking, social discovery, live streaming, creator shows, streaming media, digital content, virtual gifts, and interactive community platforms are not automatically prohibited, but must undergo enhanced due diligence based on their specific operational model. Underwriting review may cover:

• Corporate structure, beneficial owners, management team, licensing or registration status, and operating jurisdictions.

• Content moderation policies, creator or host onboarding and governance, user reporting mechanisms, account suspension rules, minor protection controls, and law enforcement escalation workflows.

• User verification, age gating, explicit consent mechanisms, anti-fraud rules, and offline safety notices.

• Clarity of product or digital item descriptions, pricing, currency display, billing descriptors, delivery logs, and refund or cancellation paths.

• Fund flows between the platform, creators, and users, revenue-sharing or virtual gift obligations, and whether any activity triggers regulated financial service requirements.

• Maintain live, accessible websites and applications that clearly display merchant identity, contact details, item pricing, refund policies, Privacy Policy, and Terms of Service.

• Ensure processed transactions match the approved business profile, without using undeclared domains, redirect cloaking, mirror sites, or third-party transaction laundering.

• Avoid collecting payment or identity data beyond operational necessity, and enforce strict access controls over credentials and API endpoints.

• Retain verifiable records of content moderation, cardholder authorization, orders, digital delivery, refunds, complaints, and dispute evidence.

• Immediately report and contain any discovered unlawful content, fraud spikes, account takeovers, data breaches, or material business model changes.

Cropay may conduct risk-based document re-verification, website inspections, transaction monitoring, and partner institution inquiries. Merchants must cooperate within reasonable timeframes. In response to suspected violations, Cropay may require remediation, restrict transaction parameters, hold settlement funds, decline transactions, or suspend or terminate services, and may retain or disclose records where required by law.

To avoid prejudicing investigations, breaching confidentiality obligations, or enabling circumvention of risk controls, Cropay may not disclose all monitoring parameters or specific reasons for enforcement actions. Enforcement measures do not constitute a judicial or regulatory determination of illegality by Cropay.

Reports of suspected merchant violations, prohibited content, or unauthorized transaction activity may be sent to Steven@cropay.com. Please include the merchant or website name, relevant URLs, dates, order or transaction reference numbers, and a description of the issue; never send full card numbers (PAN) or CVV codes. Restricted merchants may submit factual clarifications, remediation evidence, and a review request through the same channel; submission of a review request does not guarantee service restoration.