Acceptable Use Policy

1.Scope, incorporation, and acceptance

This Policy is part of, and is incorporated by reference into, the ComplyRUO Terms of Service. It applies to every Merchant, to every person who accesses or uses ComplyRUO on a Merchant’s behalf, and to all storefronts, listings, product pages, labels, marketing, and transactions processed through or in connection with the Service.

By installing, accessing, or using the Service, or by clicking to accept it, the Merchant accepts and agrees to be bound by this Policy, and the individual accepting it represents and warrants that he or she is at least 18 years of age and has full legal authority to bind the Merchant entity to this Policy and the Terms of Service. Continued use of the Service after this Policy is posted or updated is itself acceptance of the then-current Policy. The Merchant is fully responsible and liable for all acts and omissions of its owners, officers, directors, members, managers, employees, agents, contractors, representatives, and any person who accesses or uses the Service through the Merchant’s account, credentials, integration, or storefront, and any violation of this Policy by any such person is a breach by the Merchant.

This Policy also incorporates, and the Merchant must independently comply with, the “Stripe Agreements” (the Stripe Services Agreement, the Stripe Connected Account Agreement, and the Stripe Prohibited & Restricted Businesses List, each as Stripe amends them) and all rules, standards, and operating regulations of the Card Networks (Visa, Mastercard, American Express, Discover, and other payment card networks). Where this Policy, the Stripe Agreements, and the Card Network rules differ, the Merchant must comply with the strictest applicable requirement.

ComplyRUO may update, supplement, or modify this Policy at any time to reflect changes in the Stripe Agreements, the Card Network rules, applicable law, or our risk posture. Updates are effective when posted, and the Merchant’s continued use of the Service after an update constitutes acceptance of the updated Policy. It is the Merchant’s responsibility to review this Policy regularly. Nothing in this Policy is legal, regulatory, or medical advice; the Merchant is solely responsible for determining and meeting its own legal obligations.

2.The only permitted use

ComplyRUO supports exactly one use, and only this use is permitted. The Service may be used solely for the sale of Research Use Only (“RUO”) peptides that are:

• sold strictly business-to-business, never direct-to-consumer;
• sold only to qualified research counterparties, meaning licensed researchers, clinical laboratories, contract research organizations (CROs), and credentialed institutional buyers that purchase for bona fide research purposes;
• sold only to buyers who are at least 21 years of age; and
• intended exclusively for in vitro and laboratory research use, and never for human or animal consumption.

The Merchant’s products, labeling, advertising, and circumstances of sale must be consistent with this research-only intended use under the U.S. Food and Drug Administration intended-use standard at 21 CFR §201.128, under which a product’s intended use is determined from its labeling, advertising, and the circumstances of its sale. Any sale, listing, claim, label, or marketing that is inconsistent with this single permitted use is prohibited under this Policy, even if it is not specifically listed in Section 3, 4, or 5 below.

ComplyRUO does not verify buyers

ComplyRUO does not verify, vet, credential, approve, or guarantee the identity, qualifications, research purpose, age, or eligibility of any Buyer or Customer. The researcher gate and the attestation are tools that the Merchant deploys on its own storefront; they collect and record the Buyer’s self-attestation, but they are not, and must not be relied on as, ComplyRUO’s verification or approval of any Buyer. The Merchant is solely responsible for determining whom it sells to, for honoring and enforcing the gate and the attestation it deploys, and for declining or blocking any sale to a Buyer that does not qualify as a research counterparty under Section 2. ComplyRUO’s provision of the gate and attestation does not shift any of that responsibility to ComplyRUO.

3.Prohibited products

The Merchant must not sell, offer, list, market, ship, or process payment through ComplyRUO for any of the following. This list is illustrative, not exhaustive, and it tracks Stripe’s Prohibited & Restricted Businesses List, which ComplyRUO incorporates by reference. The following are prohibited:

• Direct-to-consumer sales. Any sale that is not strictly business-to-business to a qualified research counterparty.
• Anything for human or animal consumption. Any product sold, intended, labeled, or marketed for ingestion, injection, inhalation, topical application, or any other administration to humans or animals.
• Products marketed for medical or related uses. Anything marketed, described, or sold for medical, therapeutic, diagnostic, performance-enhancing, weight-loss, anti-aging, or cosmetic use.
• Incorrectly or inadequately labeled research chemicals. Stripe’s Prohibited & Restricted Businesses List expressly prohibits “incorrectly labeled research chemicals.” Any research chemical that is not correctly, completely, and accurately labeled as RUO and not for human or animal consumption is prohibited.
• Controlled substances and their analogues. Any substance scheduled under the Controlled Substances Act, and any analogue covered by the Federal Analogue Act, regardless of how it is described.
• Prescription-only drugs and regulated medical devices. Prescription-only or regulated drugs, online or unlicensed pharmacy activity, and regulated or unapproved medical devices. Stripe restricts online pharmacies and prescription-only and regulated products.
• CBD, THC, and cannabinoids. Cannabidiol (CBD), tetrahydrocannabinol (THC), and other cannabinoid products, which Stripe restricts.
• Dietary supplements and nutraceuticals. Dietary supplements, nutraceuticals, and similar consumable products.
• Pseudo-pharmaceuticals and harmful-claim products. Stripe’s Prohibited & Restricted Businesses List prohibits “pseudo-pharmaceuticals or nutraceuticals that are not safe or make harmful claims.” Any such product is prohibited.
• Anything on Stripe’s Prohibited Businesses list. Any business, product, or service that appears on, or is restricted by, Stripe’s Prohibited & Restricted Businesses List, even where not otherwise named here.
• Anything unlawful where sold or shipped. Any product or transaction that is unlawful in any jurisdiction where it is sold, shipped, delivered, or received.

Stripe permits RUO peptides only conditionally. Stripe’s guidance for pharmaceutical and peptides businesses states that peptides for research purposes may be sold on Stripe only where preventive measures are in place to ensure they are not accessible to those who would purchase research chemicals for nonresearch purposes. ComplyRUO’s researcher gate and attestation are those preventive measures, and they may not be circumvented (see Section 5).

Molecule, SKU, and denylist screen

The Merchant must, at onboarding and on an ongoing basis, certify each molecule it sells, including, where applicable, its international nonproprietary name (INN), its Chemical Abstracts Service (CAS) registry number, and the identity of each SKU. The Merchant must not list, offer, market, ship, or process payment for any substance that is scheduled under the Controlled Substances Act, or that is covered by the Federal Analogue Act, regardless of how that substance is named, labeled, abbreviated, coded, described, or marketed, and regardless of whether it is presented as a research chemical. The Merchant’s certification of its molecules, INN, CAS numbers, and SKUs is a continuing representation, and the Merchant must promptly update it whenever the Merchant adds, changes, reformulates, or relabels a product.

The Merchant acknowledges and agrees that a clean or passing compliance scan, claim-scan, or score does NOT make a prohibited substance permissible. The scans assess claims, labeling, and marketing language; they do not, and cannot, render a scheduled controlled substance or a Federal Analogue Act substance lawful or acceptable, and a prohibited substance remains prohibited under this Policy even where every claim on the page is clean. ComplyRUO maintains, and may check at listing time and on an ongoing basis, a denylist of prohibited molecules, INN, CAS numbers, names, and SKUs, and ComplyRUO may block, reject, hide, or require removal of any listing that matches or is reasonably believed to match that denylist. The denylist is not exhaustive, and the absence of a substance from the denylist is not approval of, or permission to sell, that substance.

State distributor and wholesaler licensing

The Merchant must hold, maintain in good standing, and be able to evidence, on ComplyRUO’s request, every state distributor, wholesaler, manufacturer, or other license, registration, or permit required for the sale, distribution, or shipment of the Merchant’s products into or within each ship-to state. The Merchant must determine the scheduling status of each SKU under the controlled-substance law of every destination state, and the Merchant must block shipment of any SKU that is scheduled as a controlled substance in the destination state, even where that SKU is not scheduled federally or in the Merchant’s home state. The Merchant is solely responsible for state-by-state licensing and scheduling compliance, and ComplyRUO does not determine, verify, or guarantee the Merchant’s licensing or the lawfulness of any shipment.

4.Prohibited claims and marketing

Because intended use is determined from labeling, advertising, and the circumstances of sale, the Merchant’s claims and marketing are as important as the product itself. The Merchant must not, anywhere (including on product pages, labels, packaging, certificates, social media, advertising, email, text messages, chat, or customer communications):

• claim or imply that any product treats, prevents, cures, mitigates, or diagnoses any disease or condition;
• provide dosing, dosage, administration, cycling, stacking, or usage instructions for humans or animals;
• make any “safe for human use,” weight-loss, fat-loss, muscle-building, body-building, performance-enhancing, anti-aging, longevity, or efficacy claim; or
• state, suggest, or imply that a product is intended for, or suitable for, human or animal consumption.

Concrete examples of prohibited claim language

To remove any doubt about where the line is, the following are concrete, real-world examples of words, phrases, and constructions that are prohibited anywhere in the Merchant’s storefront, listings, labels, packaging, certificates, advertising, or communications. This list is illustrative and given by way of example only; it is non-exhaustive and is offered “including but not limited to,” so that it expands the prohibition and never narrows it. Variations, abbreviations, synonyms, emojis, images, and coded or implied versions of these phrases are equally prohibited. Prohibited example language includes, but is not limited to:

• “safe for human use,” “safe for humans,” “human grade,” or “safe to inject”;
• “clinically proven,” “clinically tested,” “doctor recommended,” or “medical grade”;
• “pharmaceutical grade,” “pharma grade,” or “USP grade for human use”;
• “FDA approved,” “FDA cleared,” or “approved by the FDA”;
• “no prescription needed,” “no Rx required,” or “prescription-free”;
• “for personal use,” “great for personal use,” or “perfect for your own protocol”;
• “GLP-1 for weight loss,” “lose weight,” “drop pounds,” or “appetite suppressant”;
• “build muscle,” “shred fat,” “get lean,” “bulk up,” or “recomp”;
• “anti-aging,” “reverse aging,” “youthful skin,” or “longevity boost”;
• “99% bioavailable for the body,” “absorbs into your system,” or “maximum uptake when injected”;
• “take 250 mcg,” “X mg per day,” “once daily,” “inject subcutaneously,” “reconstitute and dose,” or any other dosing, frequency, route-of-administration, or cycling instruction;
• “cures,” “treats,” “prevents,” “heals,” or “therapy for” any disease, symptom, or condition;
• testimonials, before-and-after images, reviews, or influencer or affiliate content describing human or animal use, results, dosing, or effects; and
• the “for research use only, but” construction, and any other wink-and-nod, disclaimer-then-undercut, or coded language that signals, hints at, or implies human or animal use while nominally claiming research use.

Every product page and label must carry the RUO and FDA non-evaluation wording required by Section 8, and no content anywhere may contradict, undercut, qualify, or weaken that wording. The use of any of the example phrases above, or any equivalent, is treated as a violation of this Policy regardless of any disclaimer elsewhere on the page, and the Merchant may not argue that the prohibited line was unclear.

5.Prohibited activities

In addition to the prohibited products and claims above, the Merchant must not engage in, attempt, or facilitate any of the following activities:

• Transaction laundering or factoring. Processing, or submitting for processing, transactions that belong to another business or person, or that arise from goods or services other than the Merchant’s own permitted sales.
• Processing for third parties. Using the Merchant’s account or integration to process payments for, or on behalf of, any other party.
• Aggregation, factoring, and third-party processing. Aggregating, factoring, funneling, or processing transactions for any third party; acting as an unregistered payment facilitator, aggregator, or marketplace; or commingling another party’s sales, settlement, or funds flow with the Merchant’s own permitted sales.
• Merchant-of-record mismatch and descriptor manipulation. Submitting transactions where the merchant of record does not match the true seller of the goods or the entity fulfilling the order; misstating, falsifying, or manipulating the merchant of record, the merchant category code (MCC), the merchant or “doing business as” name, or the billing descriptor; or presenting a descriptor that does not accurately identify the Merchant and the nature of the transaction.
• Evading Card Network monitoring or registration. Manipulating, misstating, or falsifying the bank identification number (BIN), the merchant category code (MCC), merchant name, “doing business as” name, billing descriptor, transaction data, or any other information in order to evade, avoid, delay, or defeat Card Network monitoring or registration, including Visa Integrity Risk Program (VIRP) and Mastercard Business Risk Assessment and Mitigation (BRAM) registration.
• Structuring, splitting, and load balancing. Spreading, splitting, or load-balancing transaction volume across multiple accounts, descriptors, BINs, or processors to stay below monitoring, registration, or chargeback thresholds; transaction splitting or partial-authorization schemes designed to disguise true volume; or otherwise structuring activity to avoid scrutiny.
• Shell, duplicate, or third-party accounts. Opening or operating shell, duplicate, nominee, or straw merchant accounts; using a non-affiliated entity’s account, BIN, or descriptor; or routing transactions through a payment facilitator, aggregator, marketplace, or other intermediary to disguise the true business, ownership, or nature of the transactions.
• Circumventing compliance controls. Circumventing, disabling, weakening, bypassing, hiding, or tampering with the ComplyRUO researcher gate, the locked attestation, the locked RUO and FDA disclaimer wording, or any other compliance control.
• Fraud, deception, and money laundering. Fraud, deceptive or misleading practices, money laundering, terrorist financing, or any unlawful financial activity.
• Misuse of buyer data. Reselling, repurposing, or otherwise misusing Buyer or Customer data, including attestation, identity, or research-credential data, in violation of law, the Terms of Service, the Privacy Policy, or the Data Processing Addendum.

6.Sanctions, denied parties, and trade controls

The Merchant must comply with all applicable economic sanctions, export controls, and trade laws, and must not use the Service in violation of them. Without limiting the foregoing:

• OFAC and the SDN List. The Merchant must not sell to, buy from, transact with, ship to, or otherwise deal with any person, entity, vessel, or organization that is the target of sanctions administered or enforced by the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC), including any person on OFAC’s Specially Designated Nationals and Blocked Persons (SDN) List, or with any entity owned 50 percent or more, directly or indirectly, by one or more such persons.
• Embargoed and comprehensively sanctioned jurisdictions. The Merchant must not sell to, ship to, or transact in or with any country, region, or territory that is the target of comprehensive U.S. sanctions or embargoes, or with any person ordinarily resident or located there.
• Denied, debarred, and restricted parties. The Merchant must not deal with any person on a denied, debarred, blocked, or restricted party list, including the U.S. Department of Commerce Bureau of Industry and Security (BIS) Denied Persons List and Entity List, and U.S. Department of State debarment and other restricted-party lists.
• Screening covenant. The Merchant covenants that it will screen its Buyers, counterparties, and shipping destinations against the SDN List and the other lists referenced above before transacting, and will not complete any transaction that screening identifies as prohibited.
• No transacting with prohibited persons. The Merchant must not sell to, transact with, facilitate, or ship to any sanctioned, embargoed, blocked, debarred, denied, or otherwise prohibited person, entity, or jurisdiction under applicable export controls or sanctions laws.

The Merchant represents and warrants that it is not, and is not owned or controlled by, and does not act on behalf of, any person who is a sanctioned, blocked, debarred, denied, or otherwise restricted party under any applicable sanctions or trade law. A breach of this Section is a material breach of this Policy and grounds for immediate suspension, termination, and reporting under Section 9. These obligations reinforce, in operational form, the trade and sanctions provisions of the Terms of Service.

7.Card Network and Stripe rules

The Merchant must comply at all times with the Stripe Agreements and with all rules of the Card Networks, and the Merchant remains independently responsible for that compliance. ComplyRUO is software and compliance infrastructure only; it does not underwrite, approve, or guarantee processing, and it is not responsible for the acts or omissions of Stripe or any Card Network.

Nothing in this Policy, in any compliance scan, score, report, researcher gate, attestation, or other tool, and nothing else that ComplyRUO provides, is legal, regulatory, compliance, tax, accounting, financial, scientific, or medical advice, and none of it is a legal determination, an underwriting decision, an approval, or a guarantee of any outcome. ComplyRUO is not an underwriter, approver, or guarantor of any account, transaction, or result. The Merchant has obtained, or has had the opportunity to obtain, its own independent professional advice, and the Merchant does not rely on ComplyRUO, the Service, the researcher gate, the attestation, the scans, or the scores as approval, as advice, or as a substitute for the Merchant’s own compliance.

The Merchant specifically acknowledges the following high-risk monitoring programs, which apply to pharmaceutical and peptide merchants:

• Mastercard BRAM (Business Risk Assessment and Mitigation). BRAM protects the Card Networks against illegal and brand-damaging transactions. Violation fines are commonly in the range of approximately $5,000 to $200,000 or more per violation, and can run up to approximately $2,500 per day while a violation remains unresolved, and violations can lead to MATCH listing.
• Visa VIRP (Visa Integrity Risk Program). VIRP, which replaced the Global Brand Protection Program in May 2023, classifies pharmaceutical merchants as Tier 1 (the highest risk). VIRP imposes registration fees (approximately $950), per-transaction fees (approximately $0.10), and processed-volume fees (approximately 0.10%), and Visa may impose per-merchant fines up to approximately $25,000 for attempts to evade registration, for example by manipulating the merchant category code or merchant name. Visa’s acquirer monitoring (VAMP) also applies.

The Card Network rules expressly prohibit “incorrectly labeled research chemicals,” consistent with Section 3. The Merchant is fully and solely responsible for any fine, assessment, penalty, registration fee, or related charge that any Card Network, Stripe, acquirer, bank, processor, or regulator imposes in connection with the Merchant’s business, transactions, products, claims, or breach, and ComplyRUO may pass through and recover those amounts in full under Section 11 of the Terms of Service. The Merchant acknowledges these amounts can be substantial.

8.Labeling and disclaimer requirements

Labeling is a condition of permitted use, not an option. Every product page and every product label must clearly and prominently display the required RUO and FDA disclaimer wording:

For research use only. Not for human or animal consumption.

In addition, product information must reflect that the products have not been evaluated or approved by the U.S. Food and Drug Administration and are not intended to diagnose, treat, cure, or prevent any disease. The locked RUO and FDA wording presented in the ComplyRUO researcher gate and in the attestation may not be removed, hidden, altered, weakened, contradicted, or circumvented by any means.

Certificates of analysis, purity data, and similar technical documentation may be shown for research purposes, but they may not be accompanied by, and must not be used to make or imply, any prohibited medical, therapeutic, efficacy, dosing, or human-or-animal-consumption claim. Where any product information would conflict with the required disclaimer wording, the disclaimer controls and the conflicting information must be removed.

9.Monitoring, test purchases, and enforcement

The Merchant authorizes ComplyRUO to scan, review, record, and monitor the Merchant’s storefronts, product pages, labels, listings, marketing, and communications, including a weekly compliance scan, to assess compliance with this Policy.

The Merchant further acknowledges and agrees that ComplyRUO, and its agents, contractors, and service providers, may at any time, with or without prior notice, and using ComplyRUO’s own identity or third-party, undercover, or “mystery shopper” identities, place test or mystery-shopper orders, add items to cart, attempt or complete checkout, and conduct undercover content, listing, and marketing checks, in order to verify that the researcher gate, the attestation, the RUO and FDA labeling, the prohibited-claim rules, and the business-to-business-only requirements are actually being enforced on the Merchant’s storefront. The results of any such test purchase, mystery-shopper order, or content check may be used as grounds for the consequences in this Section and may be reported under the Terms of Service.

Upon any actual or suspected violation, or upon any risk to ComplyRUO, Stripe, or the Card Networks, ComplyRUO may, at its sole discretion and without prior notice:

• suspend, throttle, restrict, or terminate the Merchant’s access to the Service;
• remove or disable the integration;
• remove, hide, or require correction of any non-compliant product, listing, claim, or content;
• report the Merchant, the violation, and related information to Stripe, the Card Networks, banks, acquirers, processors, regulators, and law-enforcement or other authorities;
• cause or contribute to the Merchant being listed on the Mastercard MATCH system (the Member Alert to Control High-Risk Merchants) and the Terminated Merchant File (TMF), and cooperate with any resulting investigation; and
• pass through, charge, set off, invoice, and otherwise recover any fines, assessments, penalties, and related amounts in accordance with Section 11 of the Terms of Service.

Mandatory suspension and reporting for prohibited-substance violations

Notwithstanding the discretionary measures above, upon a confirmed prohibited-product or controlled-substance violation (including the listing, offer, shipment, or processing of any scheduled controlled substance or any Federal Analogue Act substance), ComplyRUO WILL suspend the Merchant’s access to the Service and MAY report the Merchant, the violation, and related information to law-enforcement and other authorities, to Stripe, and to the Card Networks. The Merchant acknowledges that suspension in this circumstance is mandatory and not discretionary, and the Merchant accepts that consequence.

The Merchant acknowledges that a MATCH or Terminated Merchant File listing can remain for approximately five years and can effectively bar the Merchant from accepting payment cards across processors and acquirers, and the Merchant accepts and assumes that consequence.

ComplyRUO is not obligated to monitor, and any monitoring, scanning, test purchase, mystery-shopper order, or review that ComplyRUO performs is not a guarantee of compliance, of approval, or of any outcome, and does not relieve the Merchant of its own responsibility to comply fully with this Policy, the Stripe Agreements, the Card Network rules, and all applicable law. The absence of enforcement in any instance, and ComplyRUO’s failure to act on any one violation, is not a waiver of ComplyRUO’s right to act on that or any other violation.

10.Acknowledgment, assumption of risk, and survival

The Merchant acknowledges that the sale of research-use-only peptides is a high-risk vertical and that account review, holds, reserves, freezes, fines, chargebacks, MATCH or Terminated Merchant File listing, suspension, and termination by Stripe, banks, acquirers, processors, or the Card Networks are foreseeable risks of operating in it.

THE MERCHANT EXPRESSLY ASSUMES ALL RISK OF ACCOUNT REVIEW, HOLDS, RESERVES, FREEZES, FINES, CHARGEBACKS, MATCH OR TERMINATED MERCHANT FILE LISTING, SUSPENSION, AND TERMINATION BY STRIPE, ANY BANK, ACQUIRER, PROCESSOR, OR CARD NETWORK, AND WAIVES ALL RECOURSE AGAINST COMPLYRUO AND CEVGATE LLC FOR ANY OF THEM, AS MORE FULLY SET OUT IN THE TERMS OF SERVICE.

The Merchant’s obligations under this Policy, and ComplyRUO’s rights to enforce it, to report violations, and to pass through and recover fines, assessments, and related amounts under Section 11 of the Terms of Service, survive any suspension or termination of the Merchant’s account and the end of the Merchant’s use of the Service. This Section, together with Sections 5, 6, 7, and 9, survives termination.

11.Reporting violations

If you become aware of a violation of this Policy, or of any prohibited product, claim, or activity on a ComplyRUO-connected storefront, please report it promptly to support@complyruo.com. For general assistance, you may also contact support@complyruo.com. Reports should include enough detail to identify the storefront, listing, or transaction at issue and the nature of the suspected violation. ComplyRUO reviews reports at its discretion and may act on them under Section 9.