ACCEPTABLE USE POLICY

Last updated: July 4, 2026

This Acceptable Use Policy governs use of Lasso’s Services and is incorporated into the Lasso Terms of Service.

1. Purpose

This Policy protects the security, integrity, availability, reputation, and lawful use of Lasso’s Services and supports compliance with applicable laws, payment provider requirements, card-network rules, privacy obligations, and industry standards.

2. Applicability

This Policy applies to all users of the Services, including Merchants, employees, contractors, affiliates, authorized users, and anyone accessing the Services through a Merchant account.

By accessing or using the Services, you agree to comply with this Policy, the Terms of Service, the Privacy Policy, and applicable Pass-Through Terms.

3. Prohibited Products and Activities

Users may not use the Services to engage in, promote, facilitate, or sell:

• controlled substances, narcotics, or related paraphernalia;

• stolen goods, counterfeit products, pirated software, or infringing media;

• ammunition, firearms, weapons, explosives, or regulated weapons accessories;

• sexually explicit, obscene, pornographic, or exploitative content or services;

• hate speech, violence, harassment, abuse, or discriminatory content;

• multi-level marketing schemes, “get rich quick” offers, deceptive income claims, or abusive financial products;

• gambling, betting, odds-making, lotteries, sweepstakes, or games of chance unless expressly approved by Lasso in writing;

• products, services, or activities that violate card-brand rules, payment provider requirements, banking requirements, or applicable law.

4. Prohibited Technical Conduct

Users may not:

• violate any U.S., foreign, international, federal, state, provincial, or local law;

• attempt unauthorized access to accounts, data, systems, networks, or credentials;

• deploy malware, phishing, harmful code, credential harvesting, scraping, or unauthorized scanning;

• operate unsolicited communications, spam, or communications using rented, purchased, harvested, or unlawfully obtained lists;

• engage in chargeback avoidance, transaction laundering, payment factoring, descriptor manipulation, synthetic traffic, or load-balancing across multiple MIDs to evade monitoring;

• abuse the Services in a way that causes excessive strain, degrades availability, or disrupts other users.

5. Privacy, Identity Resolution, and Offer Network Restrictions

Users may not use the Services, Identity Resolution Services, Offer Network Services, or any related integration to:

• identify, track, profile, contact, target, retarget, advertise to, or monetize End-Customers without all notices, consents, lawful bases, and opt-out mechanisms required by applicable law;

• circumvent, ignore, or override privacy choices, consent signals, opt-outs, opt-out preference signals, Global Privacy Control signals, cookie settings, or similar mechanisms;

• use identity resolution, device fingerprinting, IP signals, probabilistic matching, identity graphs, enrichment data, or similar technologies in a way that violates applicable law or the Merchant’s privacy notices;

• disclose sensitive data, children’s data, special category data, health data, precise geolocation, biometric data, financial credentials, government identifiers, or other restricted data to identity resolution providers, offer network partners, advertising partners, or similar recipients unless expressly permitted by law and by Lasso in writing;

• misrepresent third-party offers, sponsored offers, discounts, endorsements, advertiser relationships, pricing, subscription terms, refund terms, shipping terms, or monetization arrangements;

• use the Services for unlawful discrimination, eligibility decisions, credit, housing, employment, insurance, healthcare, or other legally regulated decisions unless expressly permitted in writing by Lasso;

• use the Services in any manner that causes Lasso, a Designated Provider, identity resolution provider, offer network partner, payment provider, commerce platform, or other provider to violate law, platform rules, card-network rules, or provider terms.

5A. AI-Assisted Feature Restrictions

Users may not use AI-assisted features, content generation features, web extraction features, LLM services, or related observability tools to:

• submit sensitive data, children’s data, special category data, health data, biometric data, government identifiers, payment credentials, confidential third-party information, or regulated data unless expressly permitted in writing by Lasso;

• generate or publish unlawful, misleading, infringing, deceptive, discriminatory, defamatory, harmful, or regulated content;

• generate product claims, health claims, earnings claims, financial claims, endorsements, testimonials, pricing disclosures, refund terms, subscription terms, or compliance disclosures without independently reviewing and approving the output;

• scrape, extract, or use third-party websites, content, or data in violation of law, contractual restrictions, intellectual property rights, privacy rights, or platform terms;

• rely on AI-generated output as legal, tax, medical, financial, compliance, or professional advice.

Merchant is solely responsible for reviewing, approving, and lawfully using any AI-generated or AI-assisted output.

6. User Obligations

Users agree to:

• use the Services only in compliance with law, industry standards, the Terms of Service, this Policy, and provider requirements;

• maintain valid and provable opt-in consent for marketing communications where required;

• comply with CAN-SPAM, TCPA, ePrivacy laws, GDPR, UK GDPR, CCPA, U.S. state privacy laws, and other applicable communications and privacy laws;

• respect End-Customer privacy rights and maintain a published privacy policy that accurately describes the Merchant’s use of the Services;

• promptly process unsubscribe requests, opt-outs, consent withdrawals, and similar requests;

• maintain records sufficient to demonstrate required notices, consents, opt-outs, lawful bases, and privacy choices for any use of Identity Resolution Services, Offer Network Services, advertising, analytics, or marketing integrations;

• keep complaint rates within reasonable industry thresholds;

• cooperate with Lasso’s investigations of complaints, provider notices, regulatory requests, network alerts, chargeback patterns, privacy concerns, or security issues.

7. Monitoring and Enforcement

Lasso may monitor use of the Services to protect security, availability, compliance, users, providers, and End-Customers.

Violations may result in warnings, feature limits, transaction blocking, offer blocking, identity resolution blocking, API throttling, temporary suspension, permanent termination, provider reporting, removal of content, reactivation fees, administrative cost recovery, or legal action.

Lasso may act immediately where needed to address legal, security, fraud, abuse, payment, privacy, provider, card-network, or reputational risk.

Data retention after termination is governed by the Terms of Service.

8. Risk-Based Enforcement

Lasso may restrict or terminate access even if conduct is not expressly listed in this Policy if Lasso reasonably determines the conduct creates legal, privacy, payment, fraud, security, provider, card-network, reputational, operational, or platform risk.

Lasso may require Merchant to remove content, disable offers, disable integrations, modify consent flows, update privacy notices, pause traffic, block jurisdictions, exclude data categories, or provide compliance evidence as a condition to continued use.

Lasso has no obligation to monitor all activity or detect all violations. Any failure to enforce this Policy is not a waiver.

9. Intellectual Property Infringement

Lasso responds to copyright notices under the Digital Millennium Copyright Act.

DMCA notices should be sent to:

DMCA Agent

Legal Department

Lasso Inc.

24A Trolley Square #1339, Wilmington, DE 19806

admin@lassocart.com

A valid notice should include the information required by 17 U.S.C. § 512(c)(3). Upon receipt of a valid notice, Lasso may remove or disable access to the allegedly infringing material and notify the user. Users may submit counter-notices where permitted by law.

10. No Reverse Engineering

Users may not, and may not permit others to, copy, decompile, disassemble, reverse engineer, attempt to derive source code from, or create derivative works based on the Services except as expressly permitted by law.

Users may not use Lasso’s APIs, SDKs, integrations, data, workflows, or systems to create a competing product or service or circumvent, disable, or interfere with security features.

11. Indemnification and Limitation of Liability

Indemnification and limitation of liability are governed by the Terms of Service. Users agree to indemnify, defend, and hold harmless Lasso from claims, damages, fines, penalties, liabilities, and expenses arising from their violation of this Policy.

12. Governing Law; Dispute Resolution

This Policy is governed by the governing law and dispute resolution provisions in the Terms of Service.

13. Amendments

Lasso may update this Policy from time to time. Continued use of the Services after the effective date constitutes acceptance of the updated Policy.