Acceptable Use Policy

1. Who this applies to

This policy applies to everyone who uses the LendCore platform - borrowers, microlender staff, microlender administrators, and any third party granted access (e.g. partner referrers via API). Specific rules for each group are below.

2. Borrower rules

When you apply for a loan or use a borrower portal you must:

• Provide accurate, current information - not a friend's payslip, not an old address, not an inflated salary.
• Use only your own account. Do not let anyone else use your login.
• Tell the microlender promptly if your contact details, employment, or banking changes.
• Honour signed loan agreements and debit-order mandates.
• Raise disputes through the proper channel - contact the microlender first; do not initiate fraudulent chargebacks.

You must not:

• Submit forged documents (payslips, bank statements, IDs) - this is criminal fraud.
• Apply using someone else's identity - also criminal.
• Stack loans across multiple microlenders within a short window with intent to default.
• Use stolen banking details or unauthorised mandates.

3. Microlender staff rules

If you log in with a staff account you must:

• Use the platform only for legitimate work purposes within your role.
• Keep your login confidential. Use two-factor authentication where offered.
• Pull a bureau report only when there is a real loan application or risk-monitoring need and consent is on file.
• Document the reason for any manual override of an automated decision.
• Report suspected fraud, data breaches, or system abuse to your principal officer or directly to abuse@lendcore.neishot.com.

You must not:

• Run "vanity lookups" on family, friends, neighbours, public figures, or yourself - every action is logged.
• Share borrower data with anyone outside your microlender or its lawful sub-processors.
• Export bulk data unless your role permits it and you have a documented business reason.
• Disable, manipulate, or attempt to bypass audit logs, fraud rules, or compliance checks.
• Take borrower data with you when leaving the organisation.

4. Microlender administrator rules

If you administer a microlender's workspace you must:

• Grant staff only the permissions they need (least privilege).
• Remove access immediately when staff leave or change role.
• Maintain accurate microlender records (NAMFISA licence, contact, bank).
• Configure bureau and payment connectors using your own credentials, not credentials shared from another microlender.
• Investigate and respond to complaints raised against your microlender, and preserve evidence.
• Ensure all bureau pulls are backed by valid borrower consent that was captured by your staff in good faith.

5. Technical / system rules (everyone)

You must not:

• Probe, scan, or attempt to penetrate the platform's security.
• Submit malware, attempt SQL injection, run automated scrapers, or bypass rate limits.
• Reverse-engineer, decompile, or copy the platform code.
• Resell, sublicense, or repackage platform features without a written agreement with Nei Shot.
• Use the platform to send spam, run unsolicited marketing, or transmit illegal content.

6. Detection and enforcement

Every login, every bureau pull, every override, and every export is recorded in an immutable audit log. Anomalous patterns trigger automated fraud alerts. Nei Shot may, where appropriate:

• Suspend or terminate the account in question;
• Notify the microlender's principal officer or NAMFISA;
• Cooperate with law enforcement on subpoena or court order;
• Recover any losses through normal civil channels.

7. Reporting abuse

If you spot abuse - a fraudulent application, a suspicious staff lookup, a suspected data breach, an attempt to manipulate the system - please report it. We treat reports confidentially.

Email: abuse@lendcore.neishot.com.

8. Changes

We may update this policy. Continued use after the "Last updated" date accepts the changes. Material changes that broaden borrower obligations will be highlighted to the microlender admin.