Tryso
All policies

Acceptable Use Policy

What you may not do with Tryso, your storefront or connected services.

Last updated

This Acceptable Use Policy ("AUP") applies to everyone who uses Tryso, including organizations, their members, their storefronts and any integration connected to them. It forms part of our Terms of Service. It also reflects the policies of the platforms Tryso connects to, such as Google, Meta, TikTok, Cloudflare and payment networks, which you must follow too.

1. Illegal and harmful activity

You must not use the Service to:

  1. break any law, or help anyone else break it, including laws on consumer protection, e-commerce, tax, anti-money laundering, sanctions, export control, data protection and online safety;
  2. sell or promote illegal goods or services, or regulated goods without the required licences, including controlled drugs, weapons and explosives, counterfeit goods, stolen property, human remains, endangered species or unlicensed pharmaceuticals, alcohol, tobacco or gambling;
  3. run pyramid or Ponzi schemes, "get rich quick" offers, fake charities, or any fraudulent, deceptive or misleading practice, including fake reviews, hidden fees or bait pricing;
  4. exploit or harm minors, or host child sexual abuse material (which we report to the authorities);
  5. publish content that incites violence, promotes terrorism, harasses or threatens people, or discriminates on grounds of race, ethnicity, religion, caste, gender, sexual orientation, disability or other protected characteristics;
  6. publish sexually explicit material, or non-consensual intimate imagery;
  7. infringe intellectual property, privacy or publicity rights (see Intellectual Property and Takedown Policy); or
  8. process payments for businesses other than your own, or act as a payment facilitator, without our written approval.

2. Security and integrity

You must not:

  1. access or try to access another organization's data, accounts or systems;
  2. probe, scan or test the vulnerability of the Service, except under our vulnerability disclosure rules;
  3. introduce malware, or use the Service for phishing, credential harvesting, cryptocurrency mining or command-and-control;
  4. interfere with or overload the Service, including denial-of-service attacks or excessive automated requests beyond documented API limits;
  5. circumvent plan limits, licence checks, rate limits, authentication or billing; or
  6. resell, sublicense or white-label the Service without a written partner agreement.

3. Messaging and marketing

When you send email, SMS, WhatsApp or other messages through the Service you must have the recipient's consent where the law requires it, identify yourself, include a working unsubscribe method in marketing messages and honour opt-outs promptly. You must comply with anti-spam laws such as the US CAN-SPAM Act, Canada's CASL, the EU ePrivacy rules, the UK PECR and WhatsApp's Business Messaging Policy. Purchased or scraped lists are not allowed.

4. Advertising and tracking

When you use the Ads Manager or tracking integrations you must follow the advertising policies of Google, Meta, TikTok and the other networks, not advertise prohibited products, not target ads based on sensitive categories where prohibited, and provide your storefront visitors with any notice and consent the law requires for pixels and conversion tracking.

5. Domains and DNS

When you connect a domain, including through Cloudflare, you must own or control it. You must not use the Service to impersonate another brand, operate look-alike or typo-squatting domains, or send email from domains you do not control.

6. Personal data

You must have a lawful basis for all personal data you process in the Service, must not upload special categories of data (such as health, biometric or financial account data) unless the law allows it and you apply appropriate safeguards, and must never store full card numbers or card security codes in the Service's free-text fields.

7. Enforcement

We may investigate suspected violations. Depending on severity, we may remove content, disable a storefront, domain or integration, suspend or close an organization, withhold payouts processed through us where permitted, and report activity to the authorities or affected platforms. Where appropriate we will give notice and a chance to remedy first. We are not obliged to monitor content but may act on reports.

8. Reporting

Report abuse to [email protected], security issues to [email protected] and infringement to [email protected].

Sri Lanka supplement

These terms apply in addition to the sections above for customers and users in Sri Lanka. Where they conflict, this supplement prevails.

Sri Lanka: additional prohibited uses

Customers in Sri Lanka, and anyone targeting Sri Lankan users, must not use Tryso to:

  1. commit any offence under the Computer Crimes Act No. 24 of 2007, including unauthorised access to computers or data and unauthorised modification of data;
  2. publish prohibited statements or engage in conduct that is an offence under the Online Safety Act No. 9 of 2024;
  3. advocate national, racial or religious hatred in breach of the International Covenant on Civil and Political Rights (ICCPR) Act No. 56 of 2007;
  4. publish obscene material in breach of the Obscene Publications Ordinance;
  5. launder money or finance terrorism, or avoid reporting obligations under the Prevention of Money Laundering Act No. 5 of 2006 and the Financial Transactions Reporting Act No. 6 of 2006;
  6. commit fraud involving cards or payment devices under the Payment Devices Frauds Act No. 30 of 2006;
  7. sell medicines, medical devices or borderline products without registration under the National Medicines Regulatory Authority Act No. 5 of 2015, or sell liquor, tobacco or lottery and gaming products without the required licences; or
  8. send unsolicited commercial SMS contrary to the directions of the Telecommunications Regulatory Commission of Sri Lanka.

Sri Lanka: cooperation with authorities

We comply with lawful orders of Sri Lankan courts and authorities, including the Online Safety Commission, the Sri Lanka Police and the Financial Intelligence Unit. Where the law allows, we will tell the affected organization before disclosing its data.