Draft policy for operator review. This theme is connected to WHMCS: a configured installation can create customer accounts, orders, invoices and support records, and use enabled payment and service modules. Before adopting this policy, the operator must complete its verified identity, contacts, service terms and actual data practices. Installing the theme does not configure those business settings.
- Applies to
- Every service & reseller
- Core requirement
- Authorised, lawful use
- Enforcement
- Proportionate to the issue
Scope and responsibility
This model policy applies to the full Weeby catalog, including hosted websites, cloud and dedicated infrastructure, reseller accounts, game servers, domains, email, certificates, VPN, design, migration, backups and managed tasks. It also applies to activity carried out through customer-controlled users, applications or downstream reseller accounts.
Use a service only where you have the legal right and permission to do so. Keep account details accurate and ensure that the material, software, domains and data you supply can lawfully be used for the intended purpose. Specific product limits remain those stated in the accepted order.
Prohibited activity
- Illegal content, exploitation or abuse, including child sexual abuse material, trafficking, credible threats and material that unlawfully infringes another person’s rights.
- Malware distribution, phishing, credential theft, impersonation, payment fraud or infrastructure operated to facilitate those activities.
- Unauthorised access, scanning, exploitation, denial-of-service attacks, interception or interference with systems, accounts or communications.
- Knowingly hosting stolen information, distributing unlicensed software or using a service to infringe intellectual property rights.
- Circumventing an account suspension, concealing the responsible account holder, falsifying verification material or reselling access contrary to the accepted agreement.
- Using a service in breach of applicable sanctions, export restrictions, court orders or other binding legal requirements.
Authorised security testing needs a clearly defined scope and permission from the affected parties. Owning an account does not authorise testing of another customer, the provider’s shared infrastructure or an unrelated network.
Resources and network integrity
Stay within the purchased resource allocation and any published, measurable service limits. Do not deliberately disrupt shared storage, CPU, memory, network capacity, IP reputation or administrative systems. Resource-intensive tasks should use a suitable plan rather than evading controls.
A live operator must disclose restricted workloads and usage limits before purchase. This model does not invent an unlimited-use promise or a hidden resource threshold. Cryptocurrency mining, automated bulk activity or other specialist workloads require explicit authorisation where the service rules restrict them.
Maintain reasonable security for software under your control. If a website, mailbox or server is compromised, cooperate with containment and remediation rather than continuing the affected traffic.
Email and outbound messaging
Professional Email and mail sent from any hosted service must comply with applicable messaging rules and the selected provider’s sending limits. Do not send unsolicited bulk messages, use harvested or purchased recipient lists without a lawful basis, forge sender information or operate open relays.
Use accurate sender details, honour applicable unsubscribe and suppression obligations, and configure the required DNS authentication. Do not use an ordinary mailbox plan as an unapproved bulk-mail platform. A dedicated sending service, if offered, requires its own agreed scope.
Mailbox compromise, repeated abuse reports or harmful traffic may justify temporary restrictions on the affected sending function while the issue is investigated. The restriction should be proportionate and communicated where practicable.
Product-specific safeguards
| Service area | Expected use |
|---|---|
| Domains & SSL | Provide accurate validation information, maintain authority over the domain and keep private keys secure. Do not obtain a certificate or name through impersonation or use it to facilitate abuse. |
| VPN | Do not use the tunnel for attacks, harassment, unlawful access or abuse of another service. VPN access does not create permission to bypass legal restrictions or another party’s account controls. |
| Game Servers | Use properly licensed server software, games, mods and plugins. Respect player privacy and the relevant game publisher’s rules. Do not host cheats, exploit services or attacks against other players or servers. |
| Reseller Hosting | Maintain an abuse-contact process for downstream accounts and pass through applicable service restrictions. Respond to credible reports concerning your customers. |
| Design, migration & management | Provide only authorised access and material. Do not ask the provider to copy an unlicensed site, remove legitimate attribution, bypass access controls or migrate data without permission. |
| Backup & Recovery | Back up only systems and data you are authorised to control. Protect restoration access and do not use backup storage as an unapproved public distribution service. |
Reporting suspected abuse
A useful report identifies the affected domain, IP address or account, the activity observed, timestamps with a time zone, and evidence sufficient to locate the issue. Include a contact for follow-up. Send only material needed to assess the report; do not distribute illegal content or expose unrelated personal information.
The operator must publish a monitored abuse-reporting address or ticket department and an appropriate urgent-contact process. General contact and support forms use the configured WHMCS routing; they are not an emergency service. If there is an immediate threat to life or safety, contact the appropriate emergency authority directly.
Investigation and response
The provider may investigate credible reports and request relevant clarification. Where possible, action should target the affected content, feature or account rather than unrelated services. Immediate threats, ongoing attacks, illegal content or binding directions may require prompt restriction before customer notice.
Where lawful and practical, explain the reason for action, the required remediation and how to request a review. Preserve necessary evidence under an appropriate legal basis and retention process. Do not promise that every complaint will be resolved within an unconfigured response time.
Repeated or serious violations can lead to termination under the accepted agreement. Suspension is not itself a determination that a refund is unavailable; financial treatment remains subject to the accepted terms and mandatory law.
Review and reinstatement
An authorised customer may request review with the service reference, the reason they dispute the finding, and evidence of remediation where relevant. The live operator must identify a working route for that review.
Reinstatement depends on resolving the issue and any continuing legal or security restriction. The provider should explain outstanding conditions and the effect on retained data. See the Terms of service for cancellation and export responsibilities.
Explore the services and review the terms relevant to your project.
