Cart Billing App

Cart Billing App/Acceptable Use Policy

!Draft — not yet in force

This document is a first-pass draft prepared for review by a licensed attorney. It is not legal advice and should not be relied on. Values shown as highlighted code are placeholders that must be resolved before publication, including the contracting entity, registered address, governing law, and retention periods.

36 values still to set

All of these live in src/lib/legal/config.ts and are read from the environment. Nothing needs editing in the document text.

  • legalEntityName — legal entity name
  • entityType — entity type
  • stateOfIncorporation — state of incorporation
  • registeredAddress — registered address
  • privacyContactEmail — privacy contact email
  • billingContactEmail — billing contact email
  • governingLawState — governing law state
  • arbitrationForum — arbitration forum
  • arbitrationVenue — arbitration venue
  • liabilityLookbackMonths — liability lookback (months)
  • liabilityFloorAmount — liability floor
  • securityDisclosureUrl — disclosure policy URL
  • securityResponseTimeframe — security response timeframe
  • securityOverviewUrl — security overview URL
  • securityIncidentNoticeHours — incident notice window (hours)
  • dpaBreachNoticeHours — DPA breach notice window (hours)
  • slaSummary — SLA summary
  • sccModule — SCC module
  • accountRetentionMonths — account retention (months)
  • authLogRetentionMonths — auth log retention (months)
  • serverLogRetentionDays — server log retention (days)
  • paymentRecordRetentionYears — payment record retention (years)
  • smsConsentRetentionYears — SMS consent retention (years)
  • marketingSuppressionRetentionMonths — email suppression retention (months)
  • terminationExportDays — post-termination export window (days)
  • backupRotationDays — backup rotation (days)
  • smsDailyMessageCap — SMS daily message cap
  • abuseReviewFee — abuse review fee
  • dataCenterRegion — data center region
  • awsSesRegion — AWS region
  • smtpProviderName — SMTP provider name
  • smtpProviderRegion — SMTP provider region
  • stripeRegions — Stripe regions
  • twilioRegions — Twilio regions
  • errorTrackingProvider — error tracking provider
  • errorTrackingRegion — error tracking region

Subprocessor locations still to confirm: Stripe, Twilio, Amazon Web Services (SES), Self-hosted VPS operator, Umami Analytics.

Cart Billing App updates these documents by posting a new version with a new effective date. The version above is what applies to your account.

Acceptable Use Policy

Version 2026-09-28 · Effective 2026-09-28

This Acceptable Use Policy (the “AUP”) forms part of the Terms of Service. It applies to you, to anyone you give access to the Service, and to the business customers whose information you process through it. Using Cart Billing App to do anything described below is a material breach.

1. Prohibited uses

You may not, and may not allow anyone using the Service to:

  • use the Service in violation of law, including for anything illegal, fraudulent, or which infringes a third party’s rights;
  • Process or collect payments for anything prohibited by the Payment Processor’s acceptable use policy, for any regulated activity you are not licensed to conduct, or for any high-risk or restricted business category;
  • Harass, defraud, or impersonate your business customers, or misrepresent who you are or who you represent in a message sent through the Service;
  • Send unsolicited communications — harvest or purchase contact lists, or send any message without a valid lawful basis for that recipient;
  • Transmit malware, ransomware, or malicious code, or content that is unlawful, defamatory, or that infringes intellectual property or privacy rights;
  • Attempt to gain unauthorized access to the Service, another tenant’s data, or a third-party system, including by credential stuffing, enumeration, or exploiting a vulnerability;
  • Probe, scan, or load-test the Service or its APIs without our written permission, or in a manner that degrades service for other tenants;
  • Resell, sublicense, or provide the Service to a third party as a standalone offering without a separate written agreement, or use the white-label rights to misrepresent your identity asCart Billing App;
  • Circumvent usage, rate, or billing controls, or attempt to obtain service without paying for it;
  • Use the payment or messaging functionality to harass, stalk, or intimidate a person, or to collect a debt from a person you know is experiencing a dispute, hardship, or legal proceeding;
  • Instruct the Service to do anything unlawful by automated means, including generating discriminatory or deceptive communications;
  • Misrepresent the availability or accuracy of the Service, including by white-labelling it to suggest it is a service of another provider;
  • Use the Service in a way that encourages or enables a violation of the rules above in your own customer-facing communications.

2. Your customers

Your business customers interact with a portal that we operate on your behalf and are bound by terms you set, not by this AUP. You are responsible for their conduct. We may suspend a customer-facing portal immediately, without notice to you, where we reasonably believe a customer is using it unlawfully, in violation of this AUP, or in a way that presents risk to us, another customer, or the platform.

3. Messaging and email rules

Where you enable SMS through the Service, you must comply with the SMS Terms and Conditions, which are incorporated here. Without limiting those terms: obtain and be able to evidence consent before every message, honor opt-outs immediately, identify yourself as the sender, keep frequency within what the recipient tolerates, and observe quiet hours in the recipient’s local time.

Where you enable email, you must comply with CAN-SPAM and applicable state law: accurate headers and sender identity, a valid physical postal address, a working unsubscribe in every commercial message, and honoring opt-outs within 10 business days. You may not remove the mandatory footer we add to messages sent on your behalf.

4. APIs, webhooks, and integrations

You may use the Service as intended. You may not resell raw API access, publish a wrapper service that exposes our API without a written agreement, or attempt to circumvent rate limits by distributing requests across tenants.

If you operate an integration or a customer-facing product built on the Service, you are responsible for obtaining your own consent and legal basis, for your own privacy disclosures, and for your own security. If you send webhooks to an endpoint you control, you must verify our signature on every delivery, reject replays, and treat a webhook payload as untrusted input. Our delivery retries are bounded; design for the possibility of dropped events and reconcile state by polling.

5. Enforcement

We may investigate suspected misuse, and will do so reasonably and proportionately. Where we determine that a material breach occurred, we will normally give notice and an opportunity to cure, except where immediate action is necessary to comply with law, a Payment Processor rule, or to prevent imminent harm to a person, another tenant, or the platform. Action may include warning, suspending a specific capability, restricting or suspending a customer-facing portal, suspending your account, or terminating it in accordance with the Terms of Service.

We may disclose information to law enforcement or a Payment Processor where required, and will tell you what we have shared where legally permitted. Failure to comply with this AUP is a material breach for the purposes of the Terms, and may make you liable for the damages and statutory penalties your conduct causes, including penalties under anti-spam law. We may charge a abuseReviewFee for investigation of a substantiated abuse report, on notice.