Acceptable Use Policy
1. Who This Applies To
This policy applies to everyone who touches a Banrox system: members, visitors, business account users, API clients, partners, contractors, and anyone acting on their behalf. It is part of the Terms of Service. Where the two overlap, this policy adds detail rather than replacing anything.
2. Prohibited Conduct
Fraud, deception and identity
- Submitting false, stolen, altered, or synthetic identity information
- Opening or using an account in another person's name, or applying on someone's behalf without written authority
- Creating multiple accounts to obtain repeat trials, promotions, or referral rewards
- Impersonating Banrox, a Banrox employee, a provider, or any other person, in any channel
- Using the Services to further money laundering, sanctions evasion, terrorist financing, or any scheme to defraud
Credit and consumer data
- Obtaining or attempting to obtain a consumer report about any person other than yourself
- Using any credit information from the Services for a purpose that is not a permissible purpose under the Fair Credit Reporting Act
- Using the Services to build, enrich, or sell a database about consumers
- Uploading another person's identity documents, account numbers, or credit file
Systems and data extraction
- Scraping, crawling, spidering, harvesting, or bulk downloading any part of the Services, including rate tables, the bank directory, comparison data, and content
- Using any robot, script, headless browser, or automated means to access the Services, other than a public search engine obeying our robots file
- Circumventing a rate limit, a paywall, an authentication step, a bot defence, or any technical measure
- Reverse engineering, decompiling, or attempting to derive source code, models, or methodology
- Using Banrox content or data to train, fine tune, or evaluate a machine learning model without our written agreement
- Reselling, sublicensing, or redistributing Banrox data or output
Security
- Probing, scanning, or testing any system except as Section 4 permits
- Accessing an account, a record, or an environment you are not authorised to access
- Introducing malware, running a denial of service attack, or degrading service for others
- Intercepting or attempting to intercept traffic, or defeating encryption
- Using a stolen, tested, or enumerated payment instrument
Content and conduct
- Posting anything unlawful, defamatory, harassing, threatening, hateful, sexually explicit, or that promotes violence or self harm
- Publishing another person's private information
- Infringing anyone's copyright, trademark, or other rights
- Spamming, chain messaging, or advertising without our written agreement
- Presenting yourself as a licensed adviser, or giving individualised financial, legal, or tax advice, in any Banrox community space
3. API and Developer Rules
API keys are issued to a named entity, are revocable at any time, and may not be shared, resold, or embedded in client side code. Respect published rate limits. Cache only what the documentation permits and never cache personal information beyond the stated window. Store keys in a secret manager, rotate them on any suspicion of compromise, and tell us at [email protected] within 24 hours of a suspected exposure. Do not use the API to build a competing comparison product from our data.
4. Security Research Safe Harbour
We want to hear about weaknesses, and we will not sue you for finding one in good faith. If you follow the rules below, Banrox will treat your research as authorised, will not pursue civil action, will not report you to law enforcement, and will ask any third party to stand down if they take action over your report.
- Test only against accounts and data you own or have explicit permission to use
- Stop the moment you can demonstrate the issue. Do not extract, retain, or view more data than is needed to prove it
- Never access, modify, or delete another person's data
- No denial of service, no social engineering of staff or members, no physical intrusion, no spam
- Report privately to [email protected], give us a reasonable time to fix it, and do not publish before we agree a date
- Do not demand payment as a condition of disclosure
Full detail is at Security and Vulnerability Disclosure.
5. What Happens If Someone Breaks These Rules
Depending on severity, we may warn you, remove content, apply a rate limit, suspend a feature, suspend or close the account, revoke API access, block an address or device, refuse a refund of fees for the period of misuse, report the matter to a provider, a regulator, or law enforcement, and pursue any legal remedy available.
We act immediately and without prior notice where there is fraud, a security threat, a risk to another member, or a legal requirement. Where we act without notice, we tell you afterwards what we did and why, unless the law prevents us.
If you believe an enforcement action against you was wrong, write to [email protected] with the subject "Enforcement Appeal." A person who did not make the original decision reviews it and answers within 10 business days.
6. Reporting Abuse
Report abuse to [email protected], a security issue to [email protected], and a copyright issue to [email protected]. Tell us what you saw, where, and when. We do not disclose a reporter's identity to the person reported except where the law requires it.
7. Changes
We update this policy as new abuse patterns appear. Material changes are posted here with a new effective date and, for account holders, emailed. Continuing to use the Services after the effective date means you accept the change.