Tanqory AI Developer Guidelines

Effective: September 18, 2026
Updated: September 18, 2026
Version: 3.1

On this page

This policy applies to developers, partners, and merchants who build or use AI on Tanqory. It aligns with Singapore law and global frameworks: PDPA, GDPR/UK GDPR, CCPA/CPRA, LGPD, APPI, PIPA KR, EU AI Act principles, NIST AI RMF, and ISO/IEC 42001/23894. It layers on top of ToS, AUP, Privacy Policy, DPA, Cybersecurity Policy, and AI Data Usage Policy. If there is a privacy or legal conflict, the stricter/specific document prevails. Use of Tanqory AI (web, dashboard, mobile, API) is conditional on accepting this policy; otherwise, disable AI immediately.

1) Purpose

Explains how Tanqory AI works, what data it uses, purposes, and acceptable behavior to prevent misuse or rights harm. Sets user rights/duties for data and AI output, ensures compliance with data/AI laws. Core principles: human-in-the-loop for high-risk, privacy-first/minimization, transparency, fairness, and accountability to society/consumers.

Read disclosures on data use/scope/limitations before using output.
Do not generate illegal/misleading content (fake reviews, deceptive claims, harmful propaganda).
High-impact outputs (legal/finance/health) must be human-reviewed by qualified professionals.
We disclose model-improvement data use and provide opt-in/opt-out per Model Transparency & Data Use.
Risk assessments follow NIST AI RMF, ISO/IEC 42001/23894, EU AI Act; human oversight for high-risk/ADM.
Bias reduction and prompt-injection/jailbreak testing are periodic with logged fixes.
Minors and sensitive data get extra protection; targeted ads are disabled for minor accounts.
Prompt/output access is audit-logged.
AI incidents: notify per SLA (24/72h) and perform post-incident review.
Complaints to ai-ethics@tanqory.com; AI governance team will review.
Third-party AI passes DPA/SCC/IDTA/TIA screening; no customer data is used to train public models without legal basis and consent.
Model/system cards explain purpose/scope/limits before production use.
Cross-border transfers use lawful mechanisms with safeguards (encryption/key control) and TIA as needed.
High-impact decisions require DPIA/FRIA and human appeal channel.
Shared responsibility: Tanqory provides guardrails/tools; users must act ethically and review outputs.

2) Scope and relation to other documents

Applies to merchants, teams using AI features, developers calling AI API/SDK/webhooks, building plugins/apps, partners/resellers extending AI, and Tanqory staff/contractors with AI system access.

Covers all access channels (Web UI, Mobile App, Admin Dashboard, Developer API/SDK/Webhook) and multi-cloud (AWS/GCP/Azure) used by Tanqory.
Includes automation (batch/ETL/analytics/monitoring).
Staff/contractors must use authorized accounts (RBAC/ABAC) with audit logs for prompt/output access.
Developers/partners must complete security/AI onboarding and sign NDA before data/code access.
High-risk/ADM (EU AI Act-like) requires human oversight and clear appeal path.
Third-party AI chosen by merchants: must list provider/model/region/transfer mechanism (SCC/IDTA/BCR), and ensure no training of public models with customer data without rights.
Inform end users when AI influences rights (e.g., fraud denial, recommendations).
Customer-support AI (chatbot/voicebot) must disclose AI interaction and human contact.
External connections (payments/logistics/ads) must minimize data sent for AI.
Internal tooling (synthetic test data) must be isolated from production; no recycling real customer data for training.
Applies to all regions (SG, EE, US, and others processing customer data).
Child/sensitive data use requires prior approval and special controls (see Children/Minors & Sensitive Use).
QA/monitoring tools (heatmap/replay/screenshot) must mask/redact PII and follow cookie/consent rules.
AUP prohibitions always apply: no malware, phishing, deceptive deepfakes, IP infringement.
Cross-border transfers follow regional appendices and strongest applicable law with safeguards (encryption, key control, TIA).
AI issue/incident channels: ai-ethics@tanqory.com, security@tanqory.com.
Users/partners must honor opt-out/purge SLAs in Model Transparency & Data Use and Data Lifecycle & Retention.
Ads/Recommender use must follow transparency rules with clear labels/reasons.
All in-scope parties must be audit-ready on complaints/regulatory/contractual requirements.

3) Key definitions

AI Tools: Tanqory or partner AI features (text generation, recommendations, behavior analysis/segmentation, sales forecasting, layout, fraud/risk scoring), front-end and back-end.
AI Model: ML/DL/LLM models (foundation + fine-tuned + app/store tuning) with model/system cards.
Prompt Data: user inputs plus system context (e.g., aggregated purchase history, product taxonomy).
AI Output: model-generated results (text/summaries/analysis/reports) tagged for provenance (human vs AI) and traceability.
Training Data: datasets for training/tuning/testing (merchant/public/synthetic) under license; customer data not mixed across tenants without rights.
(Other terms are used consistently throughout; all processing must follow minimization, lawful basis, and opt-out/opt-in settings.)

4) Model transparency & data use

Disclose training data sources: first-party (anonymized/aggregated store data), third-party (public/licensed), synthetic. Customer data not used to train public models without clear contract/legal basis.
Tables specify data types, de-identification, business/legal rationale. System-level fine-tuning defaults to opt-out for customer data and opt-in for identifiable data, with purge SLA (e.g., within 30 days of request).
Users can configure via dashboard/forms; confirmations provided when disabled/purged.
No secret training on user prompts/outputs; transparency notice plus controls for use.
Respect robots.txt/metadata opt-outs on third-party content.
Watermark/provenance metadata on generated content where feasible; disclose AI-generated outputs.
Provide model cards with risk class, intended/prohibited uses, quality metrics, known limits.

5) Data minimization & privacy

Collect/process only necessary data for the stated purpose; mask/pseudonymize PII before sending to models.
Use privacy by design/default: access controls, encryption in transit/at rest, short retention, redaction pipelines, and synthetic data for testing.
Logging: minimize to necessary telemetry; redact PII; set expiry (e.g., logs 90–180 days); separate dev/test/prod.
Honor DSAR/opt-out/erasure with purge/retrain flows; record completion.
No public-model training with customer secrets; enterprise agreements only.
Children/sensitive data require explicit basis and extra controls; otherwise blocked.

6) Security and controls

MLOps/CI-CD with separate staging/prod, automated validation, model registry (lineage/version/checksum).
API gateway with OAuth2/JWT/mTLS, rate limiting to prevent abuse/model extraction; real-time/offline monitoring, auto-rollback.
Incident response/BCP for data breach/AI incidents: containment, forensics, notify, recovery, post-mortem, kill switch/fallback for high-risk.
Multi-layer safety classifiers (moderation/intent), policy engine, block/allow lists for risky prompts/outputs.
PII detection/masking in data/log pipelines; synthetic regulated test sets to catch hallucinations/illegal claims.
Security testing cycles (prompt injection/jailbreak, model extraction/inversion) and supply-chain checks (SBOM/patching).
Differential privacy/clipping, canary strings for leakage detection; drift detection with alerts and retrain triggers.

7) High-risk/ADM safeguards

Human oversight and appeal channels mandatory.
DPIA/FRIA before deployment; maintain decision logs and rationale.
Accuracy/robustness thresholds and monitoring; clear user notices when ADM impacts rights.
No sole reliance on AI for credit/employment/other critical decisions without human review.

8) Prohibited/misuse

No illegal content, IP infringement, hate/discrimination/violence, fraud (fake reviews, deceptive claims), impersonation, or systematic mis/disinformation.
AI should not be the sole basis for lending, hiring, or other significant decisions; if used, perform DPIA/FRIA and provide human override.

9) Liability limits for AI output

AI output is not legal/tax/medical/investment advice. Tanqory does not guarantee accuracy or compliance in all jurisdictions. Merchants must review/approve output before publication or binding use; legal/tax outputs require professional review. Liability is limited per ToS (e.g., recent service fees) and excludes indirect/consequential damages.

10) IP in AI output

Generally, merchants may use AI output for their stores; Tanqory does not claim brand ownership of merchant-created content. Tanqory may use output as needed for display/logging/backup and anonymized/aggregated model improvement, not to promote other stores contrary to trade secrets. Merchants are responsible for third-party IP in inputs; Tanqory-generated outputs follow agreed IP/indemnity terms. Synthetic media must carry watermark/metadata and AI-generated disclosure.

11) Third-party AI and integrations

Some features use third-party models/APIs. Providers must meet security/privacy standards and may not train public models on customer data without contract/legal basis. Subprocessors are listed in Privacy Policy/DPA. If merchants install external AI apps from the marketplace, that relationship is separate; review that provider’s Terms/Privacy and accept associated risk.

12) Internal AI governance

Tanqory AI Governance Committee conducts DPIA/FRIA for high-risk features, tracks new AI laws (EU AI Act, IMDA/PDPC SG, local laws), updates policy, and maintains decision logs, risk registers, model/system cards, and technical documentation. Merchants/developers should set internal approval policies, follow local laws for high-impact AI, and keep AI usage records (logs/ROPA) for audit/rights requests.

13) Incident reporting and complaints

If AI output is illegal or violates AUP, AI malfunctions risk personal/internal data, or third-party AI over-collects data, report immediately via dashboard “Report AI Issue” or email Legal/DPO/ai-ethics@tanqory.com. Tanqory will triage, give preliminary findings, and share remediation/timeline via durable medium.

14) Regional AI appendices (summary)

EU/UK: Respect GDPR/UK GDPR Art.22 (profiling/ADM), ePrivacy/PECR; use SCC/IDTA + TIA for transfers; consider AI Act duties for high-risk/ADM and post-market monitoring.
US: Respect CPRA “Do Not Sell/Share,” state AI duties (e.g., CO/CT), and child limits <13/16 (COPPA/state) for profiling/ads.
APAC: PDPA SG for transfers/consent; Japan APPI; Korea PIPA; Australia Privacy Act reform (if effective); add stricter local appendices as needed.
India: DPDP Act for collection/use/transfer; localization if required; follow any AI guidance.
Brazil: LGPD; monitor Brazil AI bill; add appendices for high-risk/certification if adopted.
China: PIPL, CSL, DSL, algorithmic recommendation/AI rules; data localization/security assessments before export.

15) Policy updates

Tanqory may update AI Policy for new laws/standards, feature changes, and safety/ethics improvements. Material changes update “Last Updated,” notice via dashboard/email (durable medium), and provide reasonable lead time unless immediate risk/legal need.

16) Model transparency & data use (expanded)

Training data sources separated (first-party/third-party/synthetic); customer data not used to train public models without clear contractual/legal basis.
Fine-tuning uses opt-out by default for customer data; opt-in for identifiable data; purge SLA (e.g., 30 days).
Dashboard/forms manage settings; confirmations sent.
AI-generated outputs labeled; watermark/provenance applied where feasible.
Respect third-party opt-out signals (robots.txt/metadata).

17) Risk & control mapping

Risk tiers per EU AI Act: minimal, limited, high-risk/ADM, unacceptable (prohibited). Control sets mapped to NIST AI RMF (Govern/Map/Measure/Manage) and ISO/IEC 42001/23894: human oversight, target accuracy, robustness/resilience, bias testing/mitigation, data quality, fallbacks on failure. Model/system cards state risk class, allowed/forbidden uses, required KPIs; ADM always includes human oversight and appeal.

18) Safety & incident response (detailed)

AI incident SLA: 24h for system/customer safety impact; 72h for personal data impact (GDPR/PDPA alignment).
Quarterly red-team/jailbreak tests; safe-prompt library; block/allow lists (e.g., CSAM, violence, fraud).
IR playbook: containment, notify affected parties, post-incident review in incident register.
MLOps controls, API auth/rate limits, monitoring/rollback, IR/BCP, safety classifiers, PII masking, security testing, differential privacy/drift detection as noted in Section 6.

19) Third-party AI & Subprocessors (detailed)

Publish tables of model/LLM/hosting providers with data-center country and transfer mechanisms (SCC/IDTA/BCR).
Contracts forbid using customer data to train public models; approval required before use; stop sending data if provider fails criteria or has a security event.
Whitelist/blacklist with start/stop dates.
Check data-center jurisdiction; require GDPR/PDPA-equivalent safeguards and lawful transfers.
Use VPC peering/Private Link/isolated tenancy to reduce co-mingling/attack surface.
Per-provider API quotas/rate limits; anomaly detection for misuse/exfiltration.
Audit logs for all third-party requests (time, endpoint, model version, requester).
TLS1.2+/mTLS in transit; provider encryption at rest; clear key-management terms.
Processing instructions: inference-only; no retention/training of public models.
Review provider security posture (pentest/SOC2/ISO 27001); halt data flow if failing.
Policy-based routing to block child/sensitive data from any third-party.
Monitor SLA/uptime/latency; maintain fallbacks.
Minimize data before sending: trim PII, mask/pseudonymize, synthetic IDs.
Vendor onboarding/offboarding checklists (legal/technical) with deletion on termination.
Red-team/prompt-injection/jailbreak testing of provider models to ensure policy alignment.
Client-side guardrails for external LLM APIs (safety filters/intent classifiers) pre/post call.
Third-party access tied to secrets manager/KMS with short-lived creds and rotation.
Throttle on model-extraction signals or abnormal spikes; alert teams immediately.
Provider criticality tiers (low/medium/high) set review/audit frequency and fallback needs.
Sub-subprocessors must be disclosed/approved.
DSAR/erasure/opt-out flows must propagate to third parties with deletion proof.
Service status (active/suspended/terminated) communicated via dashboard/durable medium.

20) Data lifecycle & retention

Retention tables for prompts, outputs, logs, training artifacts, model snapshots, debug traces with legal/business justification and timeframes (e.g., logs 90–180 days; training artifacts per release; snapshots time-limited for rollback). Users may request deletion/anonymization; purge within SLA after consent withdrawal/termination. Purge includes cache/backup and crypto-shredding where suitable.

SLA for DSAR/opt-out → purge/retrain (e.g., 30 days) with status notice via durable medium.
Use secrets manager/KMS for data/model keys; rotate per schedule.

21) Children/Minors & sensitive use

No profiling minors without legal basis and parental consent per local law. Must filter inappropriate content and disable targeted ads for minor accounts. Sensitive data (health/biometric/religion/politics/union) is prohibited unless lawful basis and strict controls (encryption, restricted access, periodic review); never used to train public models.

22) Governance & documentation

Model/system cards for core models with scope/limits/quality metrics. Decision logs and risk registers for risky changes; bias/accuracy test reports; audit logs for all prompt/output access with reasons and actor. Mandatory training every 6–12 months for product/engineering/legal/support; high-risk/ADM may require self-attestation or third-party audit.

Prepare self-attestation templates and external audit readiness (SOC2/ISO 27001/ISO 42001) for enterprise customers.
Maintain safe-prompt/anti-pattern knowledge base; enforce safe prompts.

23) Ads/Recommender transparency

AI ranking/recommendation/ads must show “Ad/Promoted” labels and key reasons, offer easy non-profiling mode and opt-out (Shopify-style transparency). Publish plain-language principles, examples, and how to switch/disable. AI-personalized results carry disclosures to avoid deception.

Transparent, consent-aware A/B tests; report without excessive personal data.
UX/Accessibility to meet WCAG and avoid dark patterns per law/guidance.

24) Regional appendices (summary)

See Section 14 for region highlights; apply the strictest applicable rules for profiling/ADM, transfers, and AI obligations in EU/UK, US, APAC, India, Brazil, China.

25) Vision, principles, scope

Commitment to ethical, transparent, human-centered AI across all personnel, AI systems/products (built or bought), foundation models, Gen AI tools, and data for training/testing/operations. Seven principles: fairness (bias reduction), reliability/safety, transparency/explainability, privacy/data security, accountability/governance, environmental sustainability, and human empowerment (no replacement of ethical judgment).

26) Global risk-based governance

EU AI Act-inspired tiers: (1) Unacceptable (prohibited: social scoring, harmful subliminal manipulation), (2) High-risk (HR screening, credit/insurance pricing, critical infrastructure) requiring conformity assessment, QMS, human oversight, accuracy/robustness, transparency, technical docs, audit; (3) Limited risk (Gen AI/chatbot) needs transparency (disclosure/watermark/metadata); (4) Minimal risk (spam filter). High-risk requires QMS, data governance, data sheets, technical docs, human oversight, user notice, accuracy/robustness metrics.

27) Generative AI, IP, and content

Do not input customer/trade secrets or controlled data into public models. Use enterprise-grade tools and sanitize PII before internal AI use. Gen AI content must be human fact-checked before external or business-critical use; humans remain accountable. Third-party inputs must be rights-cleared; honor opt-outs (robots.txt/metadata). Output from Tanqory tools follows agreed IP/indemnity; synthetic media must be watermarked/metadata-labeled and disclosed as AI-generated.

28) Global privacy

AI processing large/high-risk personal data requires DPIA/FRIA before launch. Respect Art.22 GDPR rights: provide human review/appeal for high-impact cases. Apply privacy by design/default (minimization, anonymization/pseudonymization, security controls) consistent with GDPR/CCPA/PDPA and local laws.

29) Bias & oversight

Bias audits for high-risk systems; fix training-data bias (re-weight/augment); monitor post-deployment for emergent bias/demographic shift. AI Governance Board (exec/legal/ethics/tech) approves risk classification, reviews DPIA/AI impact assessments, sets ethics metrics, serves as final appeal, and oversees EU AI Act alignment. Provide complaint/appeal channels for human review and decision reversal.

30) Third-party & suppliers

Contracts with external AI providers must define data ownership, training limits, and IP indemnity. Suppliers must commit to the seven principles; Tanqory reserves audit rights. LLM/foundation providers must disclose data sources for IP/bias review. Use prompt engineering and safety guardrails to prevent harmful outputs; monitor API use/rate limits and unintended leakage.

31) Enforcement & training

Mandatory training for all staff on AI Policy, confidentiality, bias awareness, and responsible Gen AI. High-risk AI teams need EU AI Act/DPIA-specific training. Violations are serious and may lead to warning, suspension, or termination—especially intentional disclosure of confidential data to public models or significant harm.