Legal

Acceptable Use Policy

Version 1.2

Version: 1.2 · Published: 16 October 2026 · Effective: on acceptance for new Workspaces; for Workspaces that accepted an earlier Version, on the date STAK gives in its notice under clause 20 of the Customer Terms of Service · Governing text: English (clause 23.9 of the Customer Terms of Service)

Issued by: STAK Global, LLC, a limited liability company formed in the State of Delaware, United States of America (file number 10798493), which owns STAK (ستاك) and the Services. Contact: [email protected].

1. Purpose and scope

1.1 This Acceptable Use Policy forms an integral part of the Agreement under clause 3.1 of the STAK Customer Terms of Service (the "Terms"). Expressions defined in the Terms have the same meaning in this Acceptable Use Policy. This Acceptable Use Policy sets out what must not be done when using the Services.

1.2 This Acceptable Use Policy applies to the Customer, all its Users and Staff Members, and anyone who uses the Services through its Workspace or its API access. The Customer is responsible for their compliance with it.

2. Unlawful activities

The Services must not be used for any of the following:

(a) any activity that breaches the law of the country where it is carried on, or breaches Kuwaiti law where that law applies to STAK or to the activity;
(b) fraud, money laundering, terrorist financing or tax evasion, or issuing sham invoices or receipts;
(c) dealing with, or on behalf of, persons or entities on applicable sanctions lists;
(d) carrying on an activity that requires a licence without holding it, such as financial or health services or selling medicines;
(e) infringing the intellectual property, privacy or other rights of others.

3. Prohibited goods and services

None of the following may be offered, sold or booked through the Public Pages or the point of sale:

(a) narcotic drugs and psychotropic substances, and any drinks or substances prohibited by Applicable Law;
(b) weapons, ammunition and explosives, except under a licence from the competent authority and within its limits;
(c) counterfeit, stolen or smuggled goods;
(d) gambling and betting services, and pornographic content;
(e) other people's Personal Data, or bank account, sign-in or card data;
(f) prescription-only medicines, except by a licensed entity and in accordance with the law;
(g) pyramid schemes or any selling scheme based on deception;
(h) any good or service that is prohibited by a Connected Provider the Customer uses to sell it.

4. Messaging and marketing

4.1 Marketing messages may be sent by WhatsApp, text message or email only to people who have agreed in advance and expressly to receive them. The Customer must keep proof of that consent.

4.2 Every marketing message must include an easy way to unsubscribe, and the Customer must respect unsubscribe requests immediately. The Services keep a record of unsubscribe requests, which must not be circumvented.

4.3 The Customer must comply with Meta's policies for WhatsApp Business, and, where the Services offer text messaging and it sends text messages through them, with the rules for registering sender names with text message providers and regulators.

4.4 It is prohibited to send misleading messages, to impersonate another person or entity, or to send bulk messages to purchased or automatically harvested numbers or addresses without their owners' consent.

5. Data and privacy

5.1 Personal Data must not be collected or entered into the Services without a lawful basis. The Services must not be used to track or monitor people unlawfully.

5.2 Subject to clause 5.4, Sensitive Personal Data, such as health and clinical data, may be entered only in the Apps designed for it, such as the clinic Apps and human resources files. It must not be entered in free-text fields or general notes.

5.3 Full payment card numbers or their security codes (CVV) must not be entered in any field of the Services. Payments are made on the payment pages hosted by Payment Service Providers, or on their certified card acceptance terminals and apps.

5.4 The Services must not be used to process data that the law requires to be stored or processed in a particular country, including the data referred to in clause 13.4 of the Terms, unless the Services show that hosting in that country is available for the App concerned.

6. Security and integrity of the Services

None of the following is permitted:

(a) attempting to access the Services, or another customer's data, without authorisation, or bypassing permission controls or the isolation between customers, except within the authorisation in clause 10.2;
(b) vulnerability scanning or penetration testing outside the authorisation in clause 10.2, unless STAK agrees to it in advance and in writing;
(c) uploading malware or malicious code, or using the Services to spread it;
(d) reverse engineering, copying or extracting the source code of the Services, except to the extent the law expressly permits or within the authorisation in clause 10.2;
(e) sharing sign-in details, or selling or reselling access to the Services without a written agreement with STAK.

7. Fair use of resources

7.1 The Services must not be used in a way that overloads their systems or disrupts others' use of them. Examples are sending excessive automated requests to the APIs, exceeding usage limits, or circumventing them.

7.2 STAK may apply reasonable limits on the number of requests, file sizes and storage, as set out in the Documentation and on the Pricing Page.

8. AI Features

AI Features must not be used for any of the following:

(a) creating content that is unlawful, misleading, offensive or infringes the rights of others;
(b) making decisions with a legal or similarly significant effect on people, such as hiring, dismissal or granting credit, without human review;
(c) attempting to circumvent the safety and security controls of these features, or entering instructions designed to extract data the User is not entitled to see;
(d) presenting AI Output as certified professional advice;
(e) use for any purpose that the European Union Artificial Intelligence Act treats as prohibited or high-risk, such as screening or ranking job applicants, evaluating employees' performance or assessing creditworthiness;
(f) removing or hiding the notice that tells End Customers they are dealing with an AI assistant.

9. Public Pages and content

9.1 The Customer is responsible for everything it publishes on its online store and other Public Pages, including content, prices, images, descriptions and terms of sale. It must ensure all of it is accurate, not misleading and compliant with Applicable Law.

9.2 The Customer must show on its Public Pages its trade name, its registration number in the relevant register, its contact details and any disclosures required by e-commerce, digital commerce or consumer protection law, including its return and exchange policy.

9.3 Public Pages must not be used for phishing or to impersonate another brand or entity.

9.4 Where people in the European Union or the United Kingdom use the Customer's Public Pages, the Customer must keep the cookie consent banner of the Services switched on whenever it adds advertising or analytics tags, such as those of Google or Meta, to those pages. The Customer is responsible, with the providers of those tags, for their use.

10. Reporting violations and vulnerabilities

10.1 Breaches of this Acceptable Use Policy and security vulnerabilities can be reported by email to [email protected]. STAK handles reports confidentially.

10.2 STAK authorises good-faith security testing of app.stakpos.com (and app.trystak.co while it remains in use), its APIs and STAK's mobile apps, and only those, using Workspaces and test accounts the tester creates, within the rules below. Testing within this authorisation is authorised access for the purposes of Law No. 63 of 2015 on Combating Information Technology Crimes. The tester must not:

(a) access, keep, change or disclose data that is not theirs;
(b) test the systems of anyone else, including hosting, network, artificial intelligence and payment providers, or any customer's accounts;
(c) degrade the Services, or carry out denial-of-service or social engineering attacks;
(d) disclose the vulnerability before it is fixed, or go beyond this authorisation in any way.

10.3 If the tester follows these rules and reports the vulnerability to STAK without delay, STAK will make no complaint or claim against them, and will confirm to any competent authority that asks that the testing was authorised. STAK cannot bind the Public Prosecution or third parties.

10.4 Anyone may report content on a Public Page that they believe is illegal, by email to [email protected], stating where the content is, why they believe it is illegal, and their name and email address (except for reports of child sexual abuse material). STAK confirms receipt and decides on the report without undue delay.

11. Action on breach

11.1 If this Acceptable Use Policy is breached, STAK may take any of the following measures, depending on how serious the breach is:

(a) giving a warning and asking for the breach to be corrected within a set period;
(b) removing the violating content or disabling the Public Page concerned;
(c) stopping message sending or restricting API access;
(d) suspending the Services under clause 11 of the Terms;
(e) terminating the Agreement under clause 19.4 of the Terms.

Measures (b), (c) and (d) are taken under clause 11 of the Terms.

11.2 STAK may report the breach to the competent authorities or to Connected Providers where the law requires it, or where it is necessary to protect others from serious and imminent harm. Any report is limited to the information needed and is subject to clause 13.3 of the Terms and the Data Processing Agreement.

11.3 STAK keeps its measures proportionate to the breach and gives the Customer the opportunity to respond where circumstances allow.

11.4 When STAK removes or restricts content, a Public Page or an account, it tells the Customer which content or service is affected, the reason (the law or the clause of this Acceptable Use Policy concerned), whether automated means were used, and how to contest the decision.

12. Changes

This Acceptable Use Policy is amended under clause 20.4 of the Terms.