Acceptable Use Policy

7.1 Why this matters. A short link service lives on the reputation of its domains. One abusive Link can get crop.sh and every customer's Custom Domain flagged by browsers, messaging apps and security vendors. We therefore enforce this policy strictly and, where necessary, before you are notified.

7.2 Prohibited content. You may not create Links, QR Codes or Pages that lead to, host, promote or facilitate:

• phishing, credential harvesting, fake login pages or impersonation of any brand, bank, government body, payment app or person;
• malware, spyware, ransomware, unwanted software downloads, browser hijackers or exploit kits;
• unsolicited bulk messaging (spam) by email, SMS, WhatsApp or any other channel, including "lead" lists sold or shared without consent;
• content that is illegal in India or in the country where you or your audience are located, including child sexual abuse material, terrorism, incitement to violence, hate speech, and content that violates the Information Technology Act, 2000 and rules made under it;
• fraud, scams, advance-fee schemes, fake job offers, fake lotteries, fake investment or cryptocurrency schemes, "tech support" scams, or UPI/payment requests that misrepresent the payee;
• counterfeit goods, unlicensed gambling, controlled substances, weapons, or regulated products sold in breach of applicable law;
• sexually explicit content involving minors, non-consensual intimate imagery, or sexual services;
• infringement of copyright, trademark, trade secret or other intellectual property rights;
• defamatory, harassing, threatening or privacy-invading content targeting a private individual;
• deceptive practices such as "cloaking" (showing one destination to our scanner and another to visitors), hidden redirects, auto-downloads, forced subscriptions, or pages that imitate system warnings.

7.3 Prohibited conduct. You may not:

• circumvent, disable or probe our safety scanning, interstitial warning page, blocklists, rate limits, Turnstile or other protective measures;
• use the Service for cookie stuffing, click injection, click flooding, affiliate or partner fraud, self-referrals, fake conversions, or any scheme to earn commissions or inflate metrics dishonestly;
• register slugs, Custom Domains or Page names that impersonate a brand, product, government body, bank or person, or that are confusingly similar to them, without authorisation;
• scrape, crawl, harvest or enumerate Links, QR Codes, Pages, analytics or other data from the Service except through the public API within its limits;
• resell, sublicense or share Workspace access or API keys with third parties outside your Organization, except as expressly allowed by an Agency or Enterprise Plan;
• create Links in bulk by automated means on the Free Plan, create multiple Free Workspaces to evade limits, or use the Service primarily as a redirector for traffic you do not control;
• interfere with the Service, attempt unauthorised access to any part of it or to other customers' data, or test its security without written permission from support@urlcrop.com;
• use the Service to send traffic to destinations that violate the terms of the platform where the Link is shared (for example destinations banned by WhatsApp, Instagram, Google Ads or app stores);
• reverse engineer, decompile or copy the Service, except where open-source licences for our SDKs expressly permit it;
• use the Service in any way that breaches applicable law, including sanctions and export control law (§25).

7.4 How we enforce. To protect our customers, End Users and domain reputation, we may at any time and without prior notice:

• scan every destination URL at creation and re-scan it on a schedule, using Google Web Risk, URLhaus, PhishTank and our own heuristics, and treat destinations whose risk is unknown as not safe for new or untrusted Workspaces;
• show an interstitial warning page before redirecting to a destination we rate as risky or unverified;
• disable, hold for review or delete a Link, QR Code, Page or Custom Domain, or block a destination domain across the Service;
• throttle, suspend or restrict a Workspace, an Account or an API key;
• remove Customer Content, including images and text on Pages;
• terminate your Account or Organization for serious or repeated breaches;
• preserve and disclose records to law enforcement, regulators, courts, security vendors and affected third parties where we are required to by law or where we reasonably believe disclosure is necessary to prevent harm;
• charge you our reasonable costs of handling abuse that you caused, where permitted by law.

7.5 Reporting and appeals. Anyone can report a Link, QR Code or Page at urlcrop.com/report or by emailing support@urlcrop.com. If one of your Links or Pages is disabled or shown behind a warning page, you can request a human review from the item's detail page in the dashboard or by replying to the notice we send. We aim to review appeals within one business day. Our Grievance Officer for the purposes of the Information Technology Act, 2000 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 is Abidhusain Chidi, reachable at support@urlcrop.com and at our registered address; complaints are acknowledged within 24 hours and resolved within 15 days of receipt, or any shorter period required by law.

7.6 Shared responsibility. You are responsible for the destinations of your Links and the content of your Pages, even when a destination changes after you created the Link. Check your destinations and keep your own websites secure. We may require additional verification (for example phone verification or a short waiting period) before new Workspaces can create Links to unknown domains.

QalbIT Infotech Pvt Ltd. Questions about this document: business@urlcrop.com.