Acceptable Use

1. Why a payments product has a list

Kessel is not only software you run: it is the route money takes to your bank. Every business taking cards sits under a chain of rules — the card networks’, the acquirer’s and Stripe’s — and the platform is answerable for the businesses on it. When a platform ignores that, the correction arrives as a batch: payouts held across a book of merchants, most of whom did nothing, all of whom find out at the counter.

So this is not a formality we would rather not have. It is the thing that keeps the other merchants on this platform getting paid.

2. Never, on any account

• Anything illegal where you operate, and anything you are not licensed to sell where a licence is required.
• Processing a payment that is not a genuine sale of your own goods or services, including running another business’s sales through your account. That is factoring or aggregation, every card network prohibits it, and it closes accounts rather than earning a warning.
• Sales whose purpose is to move money rather than to sell something: cash advances, debt settlement schemes, money transmission, currency or crypto exchange, prepaid instruments loaded for somebody else.
• Sexual services, sexual content involving anybody who has not consented to it, and anything whatsoever involving minors.
• Weapons and ammunition that may not lawfully be sold on a card or online where you are, explosives, and the precursors for either.
• Controlled substances, prescription medicine sold without a prescription, and anything marketed as treating a condition it has not been approved to treat.
• Counterfeit goods, stolen goods, and goods carrying somebody else’s brand without their permission.
• Multi-level marketing, pyramid schemes, "get rich" programmes, and anything whose real product is recruitment.
• Deceptive billing: a trial that charges without saying so, a subscription you have to telephone to cancel, a total at checkout that is not the price on the page.
• Gambling, lotteries and paid-entry sweepstakes, unless you are licensed for it and we have approved it in writing beforehand.

3. Ask first: the ones that depend

These are not banned. They are the categories where the answer depends on your licence, your country and Stripe’s own view, and where a wrong assumption is discovered at settlement with money already taken. Tell us before you sign up and we will get you a yes or a no in writing.

• Alcohol, tobacco, vapes and nicotine: ordinary licensed retail, with an age check performed by a person at the point of sale.
• Cannabis and CBD. The constraint here is not ours: Stripe cannot support cannabis in the United States at all, and CBD only on its own conditions. Do not sign up assuming it will be fine.
• Firearms and related retail, where it is lawful, licensed, and permitted by the card networks.
• Supplements, nutraceuticals and anything sold with a health claim attached.
• Ticketing and events sold far in advance, travel, and anything else where you take the money now and deliver months later. The risk is not the product; it is the chargebacks if the date never arrives.
• Pawn, high-value resale, precious metals and stones.
• Memberships, subscription boxes and anything that bills again automatically.
• Charities and fundraising, which must be registered where they claim to be.

Stripe publishes its own restricted business list, and it is a condition of the connected account you hold with Stripe rather than of your agreement with us. Where Stripe says no, we cannot say yes.

4. How you use the system

• One person, one login. Staff accounts are unlimited and free, and a shared login makes your own audit trail worthless — which matters most on the day you need it to show who voided what.
• Do not try to reach another merchant’s data, probe or load-test our systems without written permission, or work around a permission, a rate limit or an API scope.
• Do not resell, sublicense or white-label Kessel without a written agreement.
• Do not upload malware, or content infringing somebody’s rights, to a storefront, a catalog, a receipt or an order note.
• Do not script the console. The public API at /v1 exists, is documented, keyed and scoped, and is stable; the console’s own endpoints are shaped for whatever one screen needs and change when that screen does.
• Keep an API key secret and revoke one you have leaked. A key belongs to the business rather than to a person, so everything it does is attributed to the business.

5. Texts and emails to your customers

Kessel can text a receipt, confirm a booking, send a pay link and email an invoice. All of it leaves on our sending reputation — our number, our domain — which is not a detail: one merchant texting people who did not ask degrades delivery for every merchant on the platform.

• Text somebody only where they gave you the number for that purpose: a receipt they asked for, a booking they made, an order they placed.
• Do not put marketing in a transactional message. A receipt with an offer in it is a marketing message wearing a receipt’s clothes, and the carriers treat it as one.
• Kessel suppresses a number that has opted out, at the one place every message goes through. Do not route around it.
• Do not buy, scrape or otherwise acquire a list of numbers and load it into your customer records.
• The same applies to email: a receipt is not a newsletter, and marketing email needs its own opt-in and a working unsubscribe.

In the United States and Canada this is a practical matter as well as a legal one. Unconsented messaging from an unregistered number is not rejected by the carriers: it is accepted, dropped, and reported back as delivered. A sister product of ours sent 168 texts that way and delivered none of them, while every screen said "sent". Consent is what keeps the channel working at all.

6. The AI features

• Every AI feature proposes and a person applies. Do not build a process that applies proposals unreviewed: you are responsible for what you apply, exactly as if you had typed it.
• Do not paste a third party’s personal information into a prompt to have it processed. The AI features read your own records, which is the whole design.
• The assistant surface at /mcp is read-only by construction and we intend to keep it that way. An assistant reads text it did not write — an order note, a supplier email — and text can be written to persuade. The mitigation that holds is not having the capability, so please do not ask us for a write.

7. What we do about it

In the order we actually do it: we ask, we give you a deadline, we suspend. A suspension is immediate only where continuing would break the law, breach a card network rule, or put other merchants at risk.

• We tell you what the problem is, in writing, in a sentence you can act on.
• We restore access as soon as the cause is resolved.
• Money already taken is yours and is not held as leverage. Stripe may hold or reserve funds for its own risk reasons, that decision is Stripe’s, and where we know the reason we will tell you.
• Your data stays exportable throughout a suspension.
• A repeat, or fraud, ends the account under section 16 of the Terms.

8. Reporting something

If a business using Kessel is selling something on this list, tell us at legal@usekessel.com. A storefront address, a receipt or an order number is enough for us to find them. Security problems go to security@usekessel.com, and we do not pursue anybody who reports in good faith and does not go looking at other people’s data.

9. What this document is

This explains section 9 of the Terms of Service. It is a list rather than a second contract: it makes section 9 specific rather than asking you for a promise of a different kind, and where the two disagree, the Terms govern. Your connected account is separately subject to Stripe’s own restricted business list, which we do not control and cannot waive.