Acceptable use policy

We host payment infrastructure. We do not receive, hold, transmit or control anyone’s funds — payments go from your customer to a wallet only you control, and we have no key, no account balance and no position in the transaction.

That is a description of the architecture, not a legal opinion about any particular country’s regime. If the law where you operate places obligations on you as a merchant accepting crypto — registering a business, identifying your customers, reporting transactions — those obligations are yours, and using a non-custodial gateway does not remove them.

Not an exhaustive list of every bad idea, but the categories we will act on.

• Fraud and deception. Selling goods or services you do not intend to deliver, impersonating another business, phishing, or fake storefronts.
• Laundering proceeds of crime. Using invoices to give criminal proceeds a commercial-looking origin, or structuring payments to disguise their source.
• Sanctions evasion. Transacting on behalf of a person or entity subject to applicable sanctions, or to circumvent them for someone else.
• Child sexual abuse material. Any content of this kind, without qualification. Accounts are terminated immediately and reported.
• Ransomware and extortion. Collecting ransom payments, sextortion, or any payment extracted by threat.
• Weapons, explosives and controlled drugs. Where their sale to your customer is unlawful in your jurisdiction or theirs.
• Trafficking and exploitation. Any commerce in people or forced labour.
• Investment schemes that depend on recruitment. Ponzi and pyramid structures, and anything marketed on guaranteed returns.
• Stolen goods, credentials and data. Including carded goods, account credentials and personal data offered for sale.
• Attacking the service. Probing, overloading or circumventing our systems, or reselling access in a way that hides who is actually using it.

Some legitimate businesses — adult content, gambling, firearms accessories, pharmacies — are lawful in one place and not in another. We do not refuse them on principle. Tell us what you sell before you start, so neither of us finds out at the point where we have to act.

We can suspend or terminate an account, stop issuing new invoices, and refuse service. Those are real consequences: without a working gateway a storefront stops taking crypto.

We cannot freeze, seize, reverse or redirect funds, and we cannot do it for a court either. The money never touches us. A demand that we return a payment is a demand we are technically incapable of meeting, and we would rather state that plainly here than discover it during a dispute.

What we can provide, when properly compelled by a request valid in our jurisdiction, is the account information described in our privacy policy — an email address, store settings, and invoice metadata. That is the whole of what exists. Where we are permitted to tell you that such a request was made, we will.

Write to support@ownrails.com with the store or invoice reference and what you observed. A person reads it.

Where the report is credible but not clear-cut, we ask the merchant first — an accusation is not a finding, and a policy that terminates on accusation is a policy anyone can weaponise against a competitor. Where it is clear-cut, or where waiting would cause harm, we act immediately.

Child sexual abuse material is the one category with no process: the account is terminated on sight and reported to the appropriate authority.

Depending on severity: a warning, suspension while we look into it, or termination. Termination for a breach of this policy forfeits unused prepaid time, as set out in the refund policy.

Your wallet and the funds in it are unaffected in every case. Losing access to the service does not mean losing access to money you have already received, and we have no mechanism by which it could.