Acceptable Use Policy

1. Purpose

This Acceptable Use Policy ("AUP") defines the standards of conduct for all Merchants using RohoPay's Services. It is incorporated by reference into the Terms of Service and your Merchant Agreement. Violation may result in immediate suspension, termination, and forfeiture of pending settlements.

2. Prohibited Activities

The following are strictly prohibited:

• Illegal Activities: Any activity violating applicable laws, including fraud, money laundering, terrorism financing, sanctions evasion, tax evasion, or operating without required licenses.
• Fraud & Deception: Misrepresenting products, services, pricing, or the Merchant's identity. Creating fake storefronts, phishing pages, or "bait-and-switch" schemes. Collecting payments for goods/services never intended to be delivered.
• Unauthorized Reselling: Reselling payment processing services to third parties without RohoPay' written consent (e.g., acting as a payment facilitator/aggregator).
• Circumventing Controls: Attempting to bypass risk checks, settlement holds, domain allowlists, velocity limits, or KYC requirements. Using multiple accounts to evade restrictions.
• Chargeback Abuse: Intentionally generating chargebacks, colluding with customers to dispute legitimate transactions, or refusing valid refunds.
• Data Misuse: Storing full card details (PAN, CVV, expiry) in violation of PCI DSS. Using customer payment data for purposes unrelated to the transaction.

3. Restricted Business Categories

The following business types require prior written approval from RohoPay before onboarding. Operating in these categories without approval is an AUP violation.

High-Risk / Conditionally Allowed

• Adult content / services (legal jurisdictions only, age verification required)
• Gambling, betting, fantasy sports, lotteries (valid license required)
• Cryptocurrency exchanges, wallets, mining, ICOs/token sales
• Forex, CFDs, binary options, high-leverage trading
• Money transfer / remittance services (separate license typically required)
• Debt collection, credit repair, payday lending
• Travel packages, timeshares, vacation clubs (high chargeback risk)
• Subscription / continuity billing (clear cancellation required)
• Digital goods / downloadable content (high dispute risk)
• Health supplements, nutraceuticals, CBD (regulatory compliance required)
• Telemarketing, lead generation, affiliate networks
• Multi-level marketing (MLM) / network marketing

Prohibited (Never Allowed)

• Illegal drugs, controlled substances, drug paraphernalia
• Weapons, ammunition, explosives, weapon parts
• Counterfeit goods, trademark/copyright infringement
• Stolen property, fencing, money mule recruitment
• Human trafficking, exploitation, illegal immigration services
• Hate speech, extremist content, terrorism-related
• Child exploitation material (zero tolerance — immediate report to authorities)
• Malware, ransomware, exploit kits, hacking tools
• Fraud-as-a-service, carding forums, stolen credentials
• Unlicensed financial services, Ponzi schemes, pyramid schemes
• Sanctioned entities/individuals (OFAC, EU, UN lists)

4. Industry-Specific Requirements

• E-commerce: Clear pricing, shipping, return/refund policies displayed before checkout. Delivery tracking required for physical goods over UGX 100,000.
• SaaS / Subscriptions: Transparent billing terms, easy cancellation (one-click or email), prorated refunds on cancellation, advance notice of price changes.
• Marketplaces / Platforms: Must not facilitate prohibited categories. Seller KYC required. Funds held in escrow until buyer confirmation (or per marketplace policy).
• Non-profits / Donations: Valid registration certificate. Clear use-of-funds disclosure. No personal enrichment.
• Education / Courses: Accreditation or clear "non-accredited" disclosure. Refund policy for unsatisfied learners.

5. Technical Requirements

• Domain Allowlist: All checkout/redirect/callback URLs must be pre-registered in the Merchant dashboard. Unregistered domains will be rejected.
• PCI DSS: Merchants must never handle raw card data. Use RohoPay's hosted checkout or approved iframe. SAQ-A compliance required annually.
• Webhook Security: Verify RohoPay webhook signatures. Respond 2xx within 10 seconds. Implement idempotency for duplicate webhook handling.
• API Key Protection: Store keys securely (env vars, secret managers). Never commit to public repos. Rotate immediately if exposed.
• Rate Limits: Respect published rate limits. Implement exponential backoff on 429 responses.

6. Monitoring & Enforcement

RohoPay monitors Transactions for AUP compliance using automated risk scoring, manual review, and Provider alerts. We may:

• Request additional documentation at any time
• Require Merchant to modify website/app content
• Impose settlement holds, rolling reserves, or transaction limits
• Suspend API keys (test or live) pending investigation
• Terminate the Merchant Agreement immediately for material violations
• Report suspected illegal activity to law enforcement and Providers
• Share Merchant information with Providers for their compliance programs

7. Reporting Violations

To report a suspected AUP violation, use our Fraud Report Form or email compliance@rohopay.com. Include: Merchant name/URL, transaction references, screenshots, and description of the violation.

8. Changes

RohoPay may update this AUP with 15 days' notice (posted on this page and emailed to Merchants). Continued use constitutes acceptance. Material changes may require explicit re-acceptance.

9. Contact

Questions about this policy? Contact compliance@rohopay.com.