Acceptable Use Policy | Bumaga Service

1. About this document

This policy is a detailed list of actions prohibited when using the Bumaga Service platform. The Terms of Service describe general principles; the AUP fills them in with specifics.

This document applies to all users of the platform, to every service without exception, and to all content created or transmitted through the platform.

Not knowing this document does not exempt you from complying with it. By registering on the platform, you confirm that you have read the AUP and agree to follow it.

2. General principles

The core idea is simple: use the platform in a way that doesn't harm others and doesn't create problems for us.

Baseline rules that everything else builds on:

Comply with the laws of the country where you are located.
Don't harm other users of the platform or third parties.
Don't use the platform's services for purposes explicitly prohibited by this document.
Don't attempt to bypass the platform's technical or organisational restrictions.

3. Criminal activity

It is prohibited to use the platform's services to commit crimes or to prepare for them. This includes, but is not limited to:

Terrorism, terrorism financing, extremist activity.
Human trafficking, illegal migration.
Trafficking in weapons, explosives, or poisons outside the scope of law.
Trafficking in narcotics and prohibited substances.
Money laundering, sanctions evasion.
Extortion, blackmail, kidnapping.

Where credible indicators of serious offences exist, access may be restricted immediately without advance notice. Funds are handled under applicable terms and law; legally binding requests from competent authorities are processed as required.

4. Protection of minors

This is a separate section, split out from the general list of crimes — because the protection of children is absolute and a top priority.

Absolutely and without exception, the following are prohibited:

Any content exploiting minors in a sexual or violent context.
Using the services to interact with minors for the purpose of exploitation.
Distributing, producing or storing CSAM content through any platform channels.
Providing platform services to minors to help them bypass age restrictions on third-party resources.

We apply zero tolerance to the exploitation of minors. Where credible indications arise, we promptly restrict access, preserve necessary evidence and report to competent authorities where required by law. Data and remaining funds are handled under applicable requirements, without a blanket waiver of data protection rights.

5. Infrastructure attacks

It is prohibited to use the platform's services to attack external infrastructure, as well as the platform itself:

5.1. External attacks

DDoS attacks and distributed network attacks.
Authentication brute-force, password guessing.
Port and vulnerability scanning without the resource owner's consent.
Distribution of malware (viruses, worms, trojans, ransomware).
Phishing and creation of fake websites.
Spam through any channel.
Intrusion into third-party information systems.

5.2. Attacks against the platform

Attempts to exploit platform vulnerabilities.
Reverse-engineering of protective mechanisms.
Automation via unofficial APIs, parsing that bypasses rate limits.
Actions aimed at reducing the platform's availability for other users.

6. Platform fraud

Any fraud schemes using platform mechanisms are prohibited:

6.1. Escrow and deals

Knowingly unfulfillable obligations when entering an Escrow deal.
Collusion with the other party to run fictitious operations.
Manipulation of evidence when opening a dispute.
Threats or blackmail against a counterparty to influence dispute resolution.

6.2. Public registries

Filing knowingly false reports in Scam List or Red Flag.
Attempts to pressure the administration via mass reports from multi-accounts.
Blackmailing another party with a threat of placement in a public registry to obtain gain.

6.3. Payments

Attempts to forge payment screenshots.
Chargeback fraud and disputing of payment operations actually made by the user.
Use of stolen crypto wallets or payment credentials.

7. Proxy abuse

Proxies are for lawful network tasks, including testing your own resources, geo-testing, monitoring and automation that respects third-party service policies. Prohibited activities include:

DDoS attacks, brute-force, port and vulnerability scanning.
Aggressively bypassing rate limits of third-party sites in a way that creates load on their infrastructure.
Intrusion into third-party accounts or systems.
Spam via email, messengers, or contact forms.
Phishing operations and collection of third-party credentials.
Reselling IP addresses issued by the platform to third parties.

Proxies are an infrastructure resource. Complaints from owners of services targeted by destructive actions are reviewed promptly.

8. SMS activation abuse

The SMS activation service is intended for registering accounts for purposes permitted by the policies of the respective services. The following are prohibited:

Creating fake accounts for fraud on other platforms.
Registering in someone else's name with intent to mislead.
Mass account creation for public opinion manipulation, review inflation, fake mass complaints.
Using the service to recover access to third-party accounts without the owner's consent.
Bypassing anti-bot mechanisms with intent to cause damage to external services.

9. Labels abuse

The Labels service is intended for legal logistics and documentation work. The following are prohibited:

Refund fraud against retailers (refund fraud, empty parcels).
Use for sending prohibited goods, contraband, narcotics, or weapons.
Forgery of tracking numbers and documentation to mislead third parties.
Using the services to attack logistics operators and damage their reputation.

10. Multi-accounts and circumvention

Each user may hold only one account. The following are prohibited:

Creating multiple accounts by a single person to bypass limits, bonuses or checks.
Using multi-accounts to inflate reputation, manipulate votes or reviews.
Circumventing a block by registering a new account.
Selling or transferring an account to a third party.
Using an account on behalf of another person without their consent.
Creating a group of accounts for coordinated actions against other users.

11. User-to-user conduct

When communicating with other users of the platform (in disputes, deals, comments, messages), the following are prohibited:

Threats of physical violence, harm to life or health.
Insults based on race, nationality, religion, gender, sexual orientation.
Doxxing — publishing real personal data of other users without their consent.
Harassment and persistent unwanted contact after an explicit refusal of communication.
Spreading knowingly false information about other users with intent to damage their reputation.
Attempts to manipulate or coerce another user into acting against their own interests.

12. Enforcement actions

When an AUP violation is reported, we assess its nature, available evidence and the risk of further harm. Depending on the circumstances, action may be taken without advance warning, particularly for security threats.

12.1. What may happen

Temporary restrictions, suspension of services or an account block; permanent termination may apply to serious or repeated violations.
Temporary suspension of specific balance operations during a review where justified and lawful. Refunds or retention of funds are determined under applicable service terms and law, without automatic forfeiture of the entire balance.
Suspension of unfulfilled orders during a review; fulfilment and refunds are assessed under the relevant service terms and applicable law.
Publication of the violator's information in the Scam List when there is evidence of financial fraud against other users.
When indicators of serious crimes are present — compliance with binding legal requirements from competent courts.

12.2. Why no advance warning

Advance warning may be omitted when delay creates a material risk to users, infrastructure or third parties. In other cases, we may request an explanation or an opportunity to remedy the issue.

12.3. Appeal

If you believe a decision was mistaken, submit a ticket from your account or email bumagaservice@proton.me. We review the available information and communicate the outcome, subject to lawful restrictions.

A request for review can also be submitted in serious cases; this does not override restrictions required by law or necessary for user safety.

Decisions consider verified facts and the level of risk. Where a credible threat exists, access may be temporarily restricted during an investigation; final action should be proportionate to the circumstances.

13. Reporting violations

If you encounter a violation of this document — tell us.

Abuse reports are accepted via support tickets or at bumagaservice@proton.me. External reporters, including resource owners and infrastructure providers, can email us without registering an account.

When filing a report, include:

The violator's login (if known).
The service where the violation occurred.
A description of the violation and the AUP clause that was breached.
Evidence: screenshots, logs, in-platform correspondence.

False reports aimed at harming another user are themselves a violation of the AUP (see "Platform fraud").

14. Interaction with authorities

Our policy regarding requests from state authorities is built on two principles: minimisation of collected data and respect for jurisdictional boundaries.

14.1. Proactive cooperation

We review the legal basis of requests and do not disclose user information solely in response to an informal inquiry where disclosure is neither required nor permitted by applicable law.

Where applicable law requires a response to safety threats, exploitation of minors or other serious misconduct, we act in accordance with those obligations.

14.2. Binding legal requirements

We assess legally binding requests from competent authorities by verifying authority, legal grounds and the scope of information sought. We disclose information only as required under applicable law.

We aim to minimise collection, but technical logs may include IP addresses, request timestamps and URLs. Account records, transactions and service-related data may also be retained as explained in our Privacy Policy.

14.3. Requests from other jurisdictions

Requests originating in other jurisdictions are assessed under applicable law, international procedures and the obligations of the company. We do not claim that every foreign request necessarily requires a separate Saint Kitts and Nevis court order.

Transparency: we aim to limit data disclosures to what is necessary and to verify the legality of requests. General statements cannot guarantee that no requests have been received or that no disclosure is possible.

15. Changes to this policy

We may update this document as the platform evolves and new services are added. We will notify users on the platform at least 7 days before significant changes take effect.

The date of last update is shown in the document header.