Acceptable Use Policy

1. Purpose

1.1 This Acceptable Use Policy ("AUP") is part of the Mercayo Merchant Terms of Service. It lists what you must not sell or do on Mercayo. It applies to every merchant, staff member and user of the Service, and to everything published on or sent from a Mercayo store.

1.2 It also serves as the "rules and regulations" that rule 3(1)(b) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 ("IT Rules 2021") requires us to publish. Under that rule, users must not host, display, upload, modify, publish, transmit, store, update or share any information that:

• (i) belongs to another person and to which the user has no right;
• (ii) is obscene, pornographic, paedophilic, invasive of another's privacy (including bodily privacy), insulting or harassing on the basis of gender, racially or ethnically objectionable, relating to or encouraging money laundering or gambling, or promoting enmity between groups on the grounds of religion or caste with the intent to incite violence;
• (iii) is harmful to children;
• (iv) infringes any patent, trademark, copyright or other proprietary right;
• (v) deceives or misleads about the origin of the message, or knowingly and intentionally communicates misinformation or information that is patently false and untrue or misleading in nature;
• (vi) impersonates another person;
• (vii) threatens the unity, integrity, defence, security or sovereignty of India, friendly relations with foreign States, or public order, or causes incitement to any cognisable offence, or prevents investigation of any offence, or is insulting to other nations;
• (viii) contains a software virus, or any other computer code, file or program designed to interrupt, destroy or limit the functionality of any computer resource;
• (ix) is an online game that is not verified as a permissible online game, or is an advertisement or surrogate advertisement for such a game or its intermediary;
• (x) violates any law for the time being in force.

2. Prohibited goods and services

You must not sell, offer, advertise, promote, or link to any of the following.

3. Restricted goods (allowed only with the right licences)

You may sell these only if you hold every required licence, registration or certification, display the details the law requires, and keep them current. We may ask for proof at any time, and may require our approval first.

4. Prohibited conduct

4.1 Fraud and deception

• Phishing stores: a store that imitates a bank, government body, courier, payment app or brand, or that collects credentials, OTPs or card details.
• Fake stores: taking orders or advance payments with no intention or ability to deliver.
• Misleading listings, fake discounts (a "was" price that never applied), hidden charges, or bait-and-switch.
• Dark patterns listed in the Guidelines for Prevention and Regulation of Dark Patterns, 2023, including:
  • false urgency;
  • basket sneaking;
  • confirm shaming;
  • forced action;
  • subscription traps;
  • interface interference;
  • bait and switch;
  • drip pricing;
  • disguised advertisements;
  • nagging;
  • trick questions.
• Fake reviews: writing, buying or incentivising them without disclosure; suppressing genuine negative reviews; or posting reviews as if from a shopper. The Consumer Protection (E-Commerce) Rules, 2020 forbid an e-commerce entity from posing as a consumer. See also BIS IS 19000:2022 on online consumer reviews.
• Misrepresenting your business, address or GSTIN, or using someone else's.
• Money laundering, or processing payments for goods you do not sell.

4.2 Misuse of cash on delivery

• Placing fake COD orders on your own or another store (for example, to inflate figures or harm a competitor).
• Using the COD one-time-code system to send codes to people who did not order, or to test phone numbers.
• Declaring to the courier a COD amount different from what the order shows the shopper owes.
• Charging a COD fee or advance that was not shown at checkout.
• Keeping a partial-COD advance where the law requires you to refund it (for example, where the goods were defective, not as described, or not delivered on time, or where you cancelled the order).
• Refusing to refund advances that your own published policy says you will refund.

4.3 Messages and spam

On Mercayo's shared email, SMS and WhatsApp senders, and on your own, you must:

• send promotional messages only to people who gave you specific, recorded consent, and never to a bought, rented or scraped list;
• follow the Telecom Commercial Communications Customer Preference Regulations, 2018 ("TCCCPR") and the DLT system: SMS goes only through registered headers and approved templates, and promotional SMS respects each recipient's preferences;
• follow Meta's WhatsApp Business Messaging Policy and Commerce Policy, and use approved templates for the right category (utility, authentication or marketing);
• include an opt-out in every promotional message, and never message someone again after they opt out. Mercayo honours opt-outs for your store automatically;
• never disguise a promotional message as transactional;
• never send messages that harass, threaten, or contain links to phishing or malware.

Mercayo may throttle, pause or stop your messages, or your access to shared senders, if your messages cause complaints, blocks, or template rejections.

4.4 Attacks and misuse of the Service

• Accessing another store's data, or trying to.
• Probing, scanning or testing the Service's security without our written permission. Responsible disclosure to security@mercayo.com is welcome.
• Denial-of-service attacks, excessive automated requests, or circumventing rate limits.
• Scraping other stores, or Mercayo, by automated means beyond what a public storefront allows; harvesting shoppers' data.
• Uploading malware, or using the Service to host or distribute it.
• Reverse-engineering, reselling or sublicensing the Service, or using it to build a competing product.
• Creating accounts in bulk, using false identities, or evading a suspension by opening a new store.
• Misusing support: social-engineering Mercayo staff, or misusing support-session links.
• Using the Service in a way that puts the Service's IP reputation, sender reputation or availability at risk for other merchants.

4.5 Content

• Content you do not have the right to use: images copied from other brands' sites, music, fonts, or trademarks.
• Content that is defamatory, or that invades privacy (for example, publishing shoppers' personal data).
• Other people's personal data, unless you are allowed to use it.

5. Reporting

5.1 Anyone can report a store or content that breaks this AUP to abuse@mercayo.com or to our Grievance Officer (Rahul Mehta, grievance@mercayo.com, +91 63525 14856).

5.2 We acknowledge reports within 24 hours and resolve them within 15 days, as rule 3(2) of the IT Rules 2021 requires. For reports of content that exposes a person's private areas, shows them in full or partial nudity or a sexual act, or impersonates them (including morphed images), we act within 24 hours.

5.3 We act on orders of a court or a notified government agency within the time the law sets: within 36 hours under rule 3(1)(d) of the IT Rules 2021, unless the order says otherwise.

6. Enforcement

6.1 If we believe you have broken this AUP, we may, depending on how serious it is:

• warn you, and ask you to fix it by a deadline;
• remove or disable access to the content concerned;
• limit features: for example, switch off COD or shared messaging, cap order values, or require a COD one-time code;
• suspend the store, or the account;
• terminate the account, and keep you from opening new ones;
• keep the information the law requires us to keep (for example, under rule 3(1)(g) of the IT Rules 2021, for 180 days after removal), and report illegal activity to the authorities.

6.2 Where we can, we will tell you what we did and why, and give you a chance to respond. You may appeal a decision by writing to the Grievance Officer. If you are not satisfied, you may appeal to the Grievance Appellate Committee under rule 3A of the IT Rules 2021.

6.3 Enforcing this AUP is at our discretion. Not acting on one breach does not permit it, or any other.

7. Changes

We may update this AUP as the law or the Service changes. We will tell you about material changes as section 20 of the Merchant Terms describes.