Acceptable Use Policy

Cobalt Payments Inc. — gateway.cxbolt.com

Effective Date: July 31, 2026

This Acceptable Use Policy ("AUP") is incorporated into and forms part of the Terms of Use. Capitalized terms have the meanings given there. Violation of this AUP is a material breach and grounds for immediate suspension or termination without notice. We may amend this AUP at any time.

1. General Standard

You will not use the Services in any manner, or in furtherance of any activity, that (a) violates any law, regulation, or Card-Network Rule; (b) infringes or misappropriates any third party's rights; (c) is fraudulent, deceptive, unfair, or abusive; or (d) may cause Cobalt, its sponsor bank, its acquirer, its processor, or its gateway provider to become subject to investigation, prosecution, or legal or regulatory action, or to suffer reputational harm.

2. Prohibited Businesses and Activities

See Terms of Use Section 6, which is incorporated here. Prohibited categories include adult content and services; cryptocurrency, virtual currency, and money services businesses; unlawful gambling; unlicensed pharmaceuticals and controlled substances; firearms, ammunition, and weapons; multi-level marketing and pyramid schemes; shell corporations; counterfeit and infringing goods; deceptive negative-option and free-trial billing; credit repair and debt elimination; advance-fee lending; telemarketing fraud; and anything violating sanctions or export-control law. Cannabis, marijuana, THC, hemp-derived products, and CBD are FULLY PROHIBITED with no approval pathway (Terms of Use Section 6.1). Alcohol and tobacco are restricted and require the licensing and age-verification obligations described in Terms of Use Sections 6.2 and 15.

3. Transaction Integrity

You will not:

Submit a transaction that does not arise from a bona fide sale of your own goods or services to your own customer;
Aggregate, factor, launder, or process transactions on behalf of any other business or person, or permit any third party to use your account;
Submit a transaction you know or should know is fraudulent, unauthorized, or not authorized by the cardholder;
Split a single transaction into multiple transactions to evade limits or requirements, or "top up" an amount without authorization;
Process a transaction to obtain cash, to refinance or transfer an existing obligation, or to collect a dishonored payment;
Deposit a transaction before delivering the goods or services, except as the Card-Network Rules permit for deposits, preorders, or delayed delivery;
Submit a duplicate, forced, or backdated transaction;
Use the Services to test cards, enumerate account numbers, or validate stolen credentials;
Process a refund to a card other than the one originally charged, except as permitted; or
Misrepresent your identity, location, business type, or merchant category code.

4. Systems, Security, and Integrity

You will not:

Introduce malware, viruses, worms, ransomware, or any malicious or destructive code;
Attempt to gain unauthorized access to the Services, other accounts, or any connected system or network;
Probe, scan, penetration-test, stress-test, or attempt to breach security or authentication measures without our prior written consent;
Interfere with or disrupt the Services, including by denial-of-service attack, flooding, or excessive load;
Circumvent rate limits, access controls, geographic restrictions, or feature entitlements;
Use bots, scrapers, crawlers, or other automated means to access, extract, or index data;
Reverse engineer, decompile, or disassemble the Services, or attempt to derive source code;
Remove, obscure, or alter any proprietary notice; or
Resell, sublicense, timeshare, or provide the Services to a third party except as expressly permitted.

5. Internet and Messaging Abuse

You are prohibited from engaging in any form of internet abuse, including: distributing, publishing, or sending unsolicited or unwelcome email or text messages; sending to purchased, harvested, scraped, or rented lists; using deceptive headers, subject lines, or sender identities; chain letters and pyramid solicitations; failing to honor an opt-out or STOP request; sending to a recipient who has revoked consent; sending prohibited content where carriers or law forbid it; and operating unregistered A2P 10DLC traffic. See Terms of Use Section 12.

6. Content and Data

You will not upload, store, or transmit content that is unlawful, defamatory, harassing, hateful, obscene, exploitative of minors, or that infringes intellectual property or privacy rights. You will not enter cardholder data, full card numbers, verification values, PINs, or Social Security Numbers into free-text fields — including notes, item names, descriptions, task comments, or attachments. You will not submit special-category data — health, biometric, genetic, or precise geolocation of consumers — except where a feature expressly requires it.

7. Users and Access

You will assign least-privilege roles, supervise your users, immediately deactivate departed personnel, and never share credentials. You are responsible for all activity under your account.

8. Enforcement

We may investigate suspected violations and, at our discretion and without liability, throttle, filter, restrict, suspend, or terminate access to all or part of the Services; withhold or reverse transactions; require remediation; report the matter to a card network, sponsor bank, regulator, or law enforcement; and report you to MATCH / the Terminated Merchant File as described in Terms of Use Section 23.5. We are not obligated to monitor, but reserve the right to do so.

9. Reporting

Report suspected abuse or a security concern to security@cxbolt.com or legal@cxbolt.com.

© 2026 Cobalt Payments Inc. All rights reserved. Cobalt Payments Inc. is a registered ISO of Wells Fargo Bank, N.A., Concord, CA. The Clover trademark logo is owned by Clover Network, Inc., a First Data company. All other trademarks, service marks and trade names referenced in this material are the property of their respective owners.