Acceptable use policy

1. Scope

This policy supplements the General Terms and Conditions. It applies to the merchant dashboard, the hosted checkout, payment links, invoices, the API, plugins and webhooks. Where it says "you", it means the merchant and everyone acting on its behalf.

Qint is a payment gateway for businesses. Crypto payments are converted and paid out by our execution partner, 24crypto, a Swiss financial intermediary subject to the Anti-Money Laundering Act. Its compliance rules therefore shape what can be processed, and a merchant that is acceptable to Qint must also be acceptable to the execution partner.

2. Prohibited businesses

You may not use Qint to accept payments for, or in connection with:

• Sanctioned persons and jurisdictions. Anyone on, owned or controlled by a person on, a sanctions list of Switzerland (SECO), the United Nations, the European Union, the United Kingdom or the United States, and any country or territory subject to comprehensive sanctions.
• Anonymising services. Mixers, tumblers and other services whose purpose is to obscure the origin or destination of funds.
• Darknet markets and goods or services offered through them.
• Illegal goods. Illegal drugs and controlled substances, counterfeit or stolen goods, stolen data and credentials, and anything whose sale is illegal where you or your customer are located.
• Weapons. Firearms, ammunition, explosives and their parts, and weapons restricted by law.
• Child sexual abuse material and any sexual content involving minors, non-consensual sexual content, and anything connected with human trafficking or exploitation.
• Fraud and deception. Ponzi and pyramid schemes, "guaranteed return" investment offers, advance-fee scams, phishing, fake shops and any business that misleads its customers.
• Unlicensed financial services. Deposit-taking, lending, securities, derivatives, token sales or ICOs, exchange or brokerage services, remittance, gambling, betting and lotteries, unless you hold the licence required where you operate and have disclosed it to us.
• Money transmission for third parties. Collecting payments on behalf of others, passing funds through your account, acting as a nested payment provider, or offering "cash-out" of crypto to people who are not your customers.
• Terrorist financing and the promotion of violence or extremism.
• Malware and attack tools, including services for credential stuffing, botnets or denial-of-service attacks.
• Infringing goods and content that violate copyright, trademark or other intellectual property rights.
• Anything the execution partner excludes. Activities that 24crypto's compliance rules do not permit, or that require prior approval you have not obtained.

If you are unsure whether your business fits, ask us before you go live. We would rather answer a question than close an account.

3. Prohibited conduct

• Providing false or incomplete information about your business, its owners or its activities, or failing to keep your merchant profile up to date.
• Using a statement descriptor, business name or checkout branding that does not match who you are.
• Opening another account after an account has been blocked or closed.
• Splitting a business across accounts, or processing payments for a business other than the one that was verified.
• Accepting a payment you know to be the proceeds of crime, or helping someone evade a sanctions or anti-money-laundering check.
• Interfering with other merchants' data, or trying to access data that does not belong to your merchant.

4. Technical rules

• API keys. Keys are shown once and are personal to your merchant. Do not share them, embed them in client-side code or publish them. Use a separate key per integration and revoke keys you no longer use or that a departing team member had access to.
• Rate limits. The API allows 120 requests per minute per key and the checkout 120 requests per minute per IP address; sign-in endpoints allow 10 per minute. Back off when you receive HTTP 429. Do not poll in tight loops — use webhooks for status changes.
• Webhooks. Register only endpoints you control, over HTTPS. Verify the X-Qint-Signature header, answer with a 2xx status promptly and treat deliveries as at-least-once (deduplicate on X-Qint-Event-Id). Do not point an endpoint at a third-party service to make it receive traffic it did not ask for.
• No scraping or automation of the dashboard. Use the API for programmatic access. Do not bypass or probe the verification flow, rate limits or access controls.
• Security testing. You may test the security of your own integration and account. Do not run denial-of-service tests, do not attempt to access other merchants' data, and report anything you find as described on the Security page.
• Plugins. Keep the Qint plugin for your shop system up to date and do not modify it in ways that bypass signature checks or status handling.

5. Cooperation with compliance checks

Under the terms, SwizzX and the execution partner may delay or block transactions in cases of suspicion and may ask you for additional documents or explanations about a payment, a customer or your business. You must answer such requests fully and promptly. Neither SwizzX nor the execution partner enters into a business relationship with your customers; checking who your customers are remains your responsibility.

6. Enforcement

If we believe this policy is being breached, we may, depending on the severity:

• ask you to explain or stop the activity;
• place individual payments under review or hold payouts;
• suspend the ability to create new payments;
• block or close the account. The terms oblige us to block or delete an account when the execution partner reports a compliance violation, and a merchant whose account was blocked may not open another.

We and the execution partner report to the authorities where the law requires it, and we cooperate with lawful requests from authorities. Funds that cannot be paid out because of a legal hold are handled according to the terms and applicable law.

7. Reporting abuse

If you believe a Qint checkout, payment link or merchant is being used for something described above — for example a fake shop or a scam using our checkout — please write to info@qint.ch. Include the URL of the checkout or payment link, what you observed and, if you have it, the payment reference. We review every report and will tell you when we have acted on it, as far as confidentiality allows.

Security vulnerabilities go to the same address; see the Security page for what to include.

8. Changes

We update this policy when the law, the execution partner's rules or the service change. The date at the top shows the current version. Continued use of Qint after a change means you accept the updated policy.