Merchant Service Agreement & Terms

1 The Aggregator Settlement Model

SMS Sync Pay operates as an authorized technical aggregator and payment settlement facilitator. By integrating our checkout API, widget, or embed SDK, you acknowledge and agree that:

• All end-customer checkout payments across Mobile Financial Services (bKash, Nagad, Rocket), Cards, and Crypto are received into central, platform-administered master accounts and wallets.
• Merchants are strictly prohibited from displaying personal or unverified payment collection numbers to end users.
• Collected net funds are credited to the Merchant's digital ledger ("Merchant Wallet") immediately following successful transaction verification.

2 Transaction Fees & Commission

Fees are determined by the Merchant's active Package Tier (e.g. Starter, Pro, Business, Enterprise) at the time of transaction settlement:

Fees are automatically computed by the system's ledger and are non-refundable once the transaction is verified and credited to the merchant wallet.

3 Withdrawal & Remittance Policy

Merchants may submit withdrawal requests for their available withdrawable balance at any time through the Merchant Portal:

• The minimum withdrawal threshold is ৳500 (or $10.00 equivalent).
• Payouts are remitted directly to the merchant's designated settlement destination (bKash, Nagad, Rocket, or Bangladeshi Bank Account via BEFTN/NPSB).
• Standard processing turnaround is 1 to 24 business hours following operational review.

4 Prohibited Activities & Compliance

Merchants are prohibited from utilizing SMS Sync Pay for unlawful or unauthorized merchandise, including but not limited to: illegal gambling, betting, unauthorized forex trading, counterfeit goods, unlicensed pharmaceuticals, or prohibited weapons. Violations will result in immediate suspension, API key revocation, and reporting to relevant regulatory bodies under the Digital Security Act and Bangladesh Bank AML/CFT regulations.

5 API Security & Confidentiality

Merchants are exclusively responsible for maintaining the confidentiality of their API Secret Key and Webhook Signatures. The Secret Key must never be embedded in client-side applications (such as frontend JavaScript or mobile APKs). All server-to-server webhook callbacks must verify the SHA-256 HMAC signature.