Acceptable Use Policy

1.1 This Acceptable Use Policy (the "Policy") governs the use of the Capay Global Payment Gateway, its APIs, SDKs, dashboards, sandbox, and related services (together, the "Services"). It is incorporated by reference into, and forms part of, the Merchant Terms of Service.

1.2 Capitalised terms not defined here have the meaning given in the Merchant Terms of Service. Where this Policy conflicts with the Merchant Terms of Service on prohibited use, the stricter restriction applies.

1.3 The Merchant is responsible for its own use of the Services and for the use by its users, integrators, and customers to the extent within its control. A breach of this Policy is a breach of the Merchant Terms of Service.

2.1 The Merchant must not use the Services for a prohibited business or, without the required licence and Capay Global's prior written approval, for a restricted business. The prohibited and restricted categories in clause 10 of the Merchant Terms of Service apply to this Policy in full, including:

• Illegal goods or services, or activity unlawful in any relevant jurisdiction.
• Unlicensed financial services, including unlicensed money transmission, lending, forex, or investment schemes.
• Adult content, gambling, and virtual-asset services where restricted, unlawful, or unlicensed.
• Weapons, controlled substances, counterfeit or infringing goods, and stolen goods.
• Pyramid, Ponzi, matrix, and other unlawful multi-level schemes.
• Transactions with Sanctioned parties or in breach of Sanctions.
• Fraudulent, deceptive, or exploitative activity, and any use a Provider or scheme prohibits.

3.1 The Merchant must not, and must not permit any person to:

• Access the Services other than through documented interfaces, or exceed applicable rate, volume, or concurrency limits.
• Circumvent, disable, or interfere with authentication, idempotency, signing, screening, risk, or security controls.
• Share, resell, sublicense, or expose API or secret keys, or embed secret keys in client-side code, mobile apps, or public repositories.
• Reverse-engineer, decompile, scrape, or create derivative works of the Platform except to the extent the law permits.
• Introduce malware, launch denial-of-service or injection attacks, probe or scan without authorisation, or attempt to gain unauthorised access to any system, account, or data.
• Use the sandbox or test endpoints to simulate, disguise, or route real-money activity, or use production credentials for load or stress testing without prior approval.
• Falsify, spoof, or manipulate request data, headers, signatures, device or location signals, or webhook payloads.
• Misuse webhooks, including failing to verify signatures, replaying deliveries, or using webhook endpoints to attack third parties.
• Interfere with, degrade, or place an undue burden on the Services, or with another merchant's use of them.
• Use the Services to build or train a competing payment-orchestration product, or to benchmark it for a competitor, without written consent.

4.1 The Merchant must collect, use, and share personal data obtained through the Services only in accordance with applicable data-protection law, the Data Processing Addendum, and the notices the Merchant provides to its own customers.

4.2 The Merchant must not use the Services to send unlawful, unsolicited, deceptive, or harassing communications, to harvest data unlawfully, or to process payments for such activity. The Merchant must not use another party's personal or payment data without a lawful basis.

4.3 The Merchant must not represent Capay Global's status, licences, or endorsement inaccurately, and must not use Capay Global's marks except as permitted.

5.1 The Merchant must not knowingly process fraudulent, unauthorised, or misrepresented Transactions, split a Transaction to evade limits or screening, process on behalf of an undisclosed third party, or use the Services for money laundering, terrorist financing, Sanctions evasion, or tax evasion.

5.2 The Merchant must not use the Services to test stolen or enumerated card numbers, to launder chargebacks, or to move value in a way designed to obscure its origin, purpose, or destination.

6.1 Capay Global may monitor use of the Services for compliance with this Policy, subject to applicable law and the Privacy Policy. Capay Global does not undertake to monitor all activity and monitoring does not relieve the Merchant of responsibility.

6.2 Where Capay Global reasonably believes this Policy has been breached, it may, with or without prior notice as the circumstances and the law allow: warn the Merchant; apply rate limits, holds, or additional verification; suspend, restrict, or terminate access; reverse or decline Transactions; and report to a Provider or a competent authority. Clause 14 of the Merchant Terms of Service governs suspension and termination.

6.3 The Merchant must report a suspected breach, security incident, or vulnerability to [email protected] promptly and must not exploit a vulnerability it discovers.

7.1 Capay Global may update this Policy in line with clause 25 of the Merchant Terms of Service. Continued use of the Services after an update takes effect constitutes acceptance.

8.1 Report abuse or security concerns to [email protected]. Data-protection enquiries: [email protected].

8.2 Related documents: the Merchant Terms of Service, the Data Processing Addendum, the AML/KYC Notice, the Privacy Policy, and the Cookie Policy.