Acceptable Use Policy

Illegal or harmful use

• Do not use the service to violate law, regulations, contracts, intellectual property rights, privacy rights, publicity rights, consumer protection rules, employment rules, tax rules, or payment rules.
• Do not use the service to facilitate fraud, theft, money laundering, counterfeit goods, unlawful gambling, illegal weapons activity, unlawful controlled substance activity, harassment, threats, abuse, exploitation, or deceptive practices.
• Do not submit content or data that is unlawful, defamatory, abusive, invasive of privacy, infringing, deceptive, malicious, or intended to harm another person or business.

Sensitive information restrictions

• Do not store social security numbers, driver's license numbers, passport numbers, full payment card numbers, bank login credentials, health information, biometric identifiers, children's information, or similarly sensitive information unless Cardstead has approved the use case in writing.
• Do not place secrets, passwords, API keys, private keys, or payment credentials in notes, free-text fields, exports, screenshots, or support messages.
• Do not upload or link to photos, files, or attachments containing sensitive information unless the product explicitly supports that workflow and the store has lawful authority to process the information.

Security abuse

• Do not attempt to bypass authentication, authorization, tenant boundaries, role permissions, billing restrictions, rate limits, logging, monitoring, or security controls.
• Do not access, search for, disclose, modify, export, or delete data that belongs to another tenant or that you are not authorized to access.
• Do not probe, scan, load test, fuzz, exploit, reverse engineer, or attack the service except as expressly allowed by the Security Disclosure Policy.
• Do not introduce malware, ransomware, spyware, worms, destructive code, credential theft tools, automated abuse, or harmful payloads.

Operational abuse

• Do not overload, disrupt, degrade, or interfere with the service, infrastructure, networks, jobs, backups, monitoring, email delivery, billing flows, or support systems.
• Do not use bots, scrapers, crawlers, scripts, or automated requests in a way that exceeds normal product use or bypasses published interfaces.
• Do not resell, sublicense, rent, time-share, or provide service bureau access to Cardstead unless a written agreement allows it.
• Do not misrepresent affiliation with Cardstead, impersonate another person, or create misleading accounts, tenants, support requests, or billing records.

Messaging and marketing

• Do not use email, SMS, support, or future messaging features to send spam, unlawful marketing, deceptive messages, harassment, or messages without required consent.
• Stores are responsible for honoring opt-outs, suppression lists, channel-specific consent, and laws that apply to their customer communications.
• Future integrations with SMS, email marketing, payment, or customer communication providers may have additional rules from those providers.

Enforcement

Cardstead may investigate suspected violations and may remove content, restrict features, revoke sessions, suspend users, suspend tenants, disable integrations, block exports, notify affected parties, or terminate access when reasonably necessary to protect the service or others.

Violations can also result in legal action, law enforcement referral, preservation of evidence, or disclosure where required by law.

Reporting abuse

Report suspected abuse, unauthorized access, policy violations, or security vulnerabilities to support@cardstead.com.