Pretty strict, normally all merchant account agreements mention that you can't process cards for anyone else or any other business/purpose/website other than the one listed. They like to keep a tight eye on that.
You can of course deal directly with credit card companies like Visa and Mastercard - they have well documented APIs for interfacing with them directly.
Back in the late 90s, RedHat bought a small company in Pittsburgh which made a rather awesome product called CCVS (http://en.wikipedia.org/wiki/CCVS) which allowed you to talk directly to the credit card companies, circumventing the merchant accounts.
My employer started using CCVS to provide direct credit card services at the time, and I wrote a PHP module which shipped for a few years as part of PHP core for using it.
Sadly, RedHat discontinued the product ; I'm not sure if anyone else has stepped up to do something similar but it was incredibly easy to use, powerful and got around the absurd restrictions most merchant accounts provide.
I'm assuming Square is talking directly to the CC clearing houses, which is how they keep their costs reasonable.
