Tanqory API License and Terms

Status Notice — Public Developer Program Launch Pending. Tanqory's public Developer Program and App Marketplace are scheduled for a future launch. Until then, API access is granted only to merchants for their own stores and to partners onboarded by Tanqory's written invitation. The full set of rights and obligations described below — particularly those relating to publishing apps in the Tanqory App Marketplace — take effect for a given developer at the moment of marketplace onboarding. These Terms are published in advance for transparency to prospective developers, app-store reviewers, and regulators.

1) Access levels and API license

Credentials and API keys. To access Tanqory APIs, you must create a developer account and obtain unique credentials (API keys, tokens, client IDs). Tanqory may provide multiple access levels/environments (sandbox vs. production) and scopes for specific functions. Use only the credentials issued to you; do not share or sublicense to third parties. Keep all API keys/secrets confidential and secure (e.g., never embed them in public repos or open-source projects). Tanqory may revoke/rotate your credentials if misuse or leakage is detected.

OAuth scopes/permissions. If Tanqory APIs use OAuth 2.0 or similar delegated authorization, request only the minimum scopes/permissions needed. Sensitive or elevated scopes may require prior review/explicit approval (similar to Google sensitive scope verification). You must comply with all consent requirements: clearly disclose to users which data/actions your app requests, honor privacy settings, and respect revocation. Do not circumvent authorization—never access endpoints/data beyond your current keys/scopes. Use only documented, permitted API methods. Using your issued credentials is a material condition of these terms.

Approval for elevated access. Some advanced features or higher rate tiers may be granted at Tanqory’s discretion via special access programs. Certain endpoints/products may be designated “restricted/private” and require registration or separate approval (analogous to Visa “Restricted” products). Obtain Tanqory’s written consent before accessing restricted APIs or running live/production use beyond sandbox testing where required. Tanqory may ask for use-case descriptions or app reviews before granting higher tiers (e.g., high-volume or commercial use).

2) Usage restrictions

When using Tanqory APIs you agree to the following (including, without limitation):

• Rate limits. Tanqory may set rate/usage quotas (e.g., max requests per second/day). Do not exceed or circumvent them. If you need more, contact Tanqory for approval. Attempts to bypass limits (e.g., multiple accounts or other workarounds) are prohibited. Tanqory may monitor and throttle/limit/suspend access if you exceed quotas or impact API stability.
• Sandbox/test use. Sandbox/test environments are for testing only with non-production data. Do not send real personal or sensitive data. Sandbox rules may disable features, use mock data, disallow load testing, and periodically purge test data. Load/soak testing against production is prohibited without Tanqory’s consent.
• No reverse engineering. Do not reverse engineer, decompile, disassemble, or attempt to derive source code or underlying concepts. Do not bypass technical protections, authentication, or security features. Interact only through documented endpoints/methods.
• Prohibited uses. Do not use the APIs unlawfully, harmfully, or to violate others’ rights (harassment, privacy violations, IP infringement, malware). Do not use the APIs to build materially competitive or look-alike services to Tanqory’s platform. Cease immediately if Tanqory designates a prohibited app/data category.
• No resale/misrepresentation. APIs are to integrate Tanqory functions into your own app only. Do not resell/sub-license API access. Do not spoof your identity/app when calling APIs. Do not embed API calls so others indirectly use your credentials; never share keys in open-source.
• Sanctions/export. Do not use or route APIs to sanctioned countries/persons/entities/items (OFAC/EU/UN/EAR/ITAR etc.); always comply with applicable export controls.
• High-risk/ADM/AI. High-risk automated decisions (credit, employment, insurance, health, civil rights) or high-risk AI/ADM use require prior DPIA/FRIA, human oversight/appeal, decision rationale, and local-law compliance (GDPR Art.22 / EU AI Act–style if applicable).

Tanqory may audit and enforce these restrictions. Violations may result in limitation, suspension, or termination of access and legal action.

3) Security and logging

Developer security obligations. Apply industry-standard security to protect data obtained via APIs and your integrations from unauthorized access. Keep keys secret, use secure storage and encrypted connections (HTTPS), promptly patch Tanqory SDKs/libraries, safeguard personal data obtained via APIs, prevent unauthorized access/use, and notify users/authorities of breaches as required by law.

Tanqory security obligations. Tanqory will use appropriate technical/organizational measures to secure the APIs and data stored/processed, but no service is 100% secure; use at your own risk. Tanqory will endeavor to protect systems and notify of material security events affecting your data/integration.

Monitoring and logs. API use implies consent for Tanqory to monitor usage/traffic for security, fraud prevention, performance, and compliance. Tanqory may collect/analyze metadata (timestamps, IPs, logs). API access may be logged and is Tanqory Confidential.

Retention and personal data. Tanqory keeps API logs as needed for legitimate business interests (debugging, security incident tracing, recordkeeping) and deletes/anonymizes per the retention policy unless law requires otherwise.

Developer logging. You should keep your own logs of API interactions (especially when personal data is involved) to support security investigations, audits, and user rights requests. Limit log retention and protect logs per applicable privacy laws.

4) Privacy, data use, and user rights

• Comply with all applicable privacy/data-protection laws (e.g., GDPR/UK GDPR, CCPA/CPRA, PDPA SG). Provide required notices/consents to end users for data you collect via the APIs.
• Use only the data necessary for your declared purpose (data minimization); do not repurpose without a valid legal basis and, where required, user consent.
• Honor user rights (access, correction, deletion, opt-out) and propagate deletions/opt-outs to your systems and any third parties you use. Provide deletion confirmation to users when required.
• Do not store sensitive data (e.g., CVV/full PAN) via the APIs; use tokenized payments only. Respect PCI DSS and applicable card-network rules.
• Cross-border transfers you make must use lawful mechanisms (SCC/IDTA/BCR/adequacy/consent) with appropriate safeguards.

5) Warranties, indemnity, and liability

• Your warranties. You warrant that: (a) you have and will maintain all rights/consents to use data via the APIs; (b) your apps will comply with law and these terms; (c) you will not infringe third-party IP or misuse data.
• Disclaimer. APIs are provided “as is” and “as available” without warranties of any kind. Tanqory disclaims all implied warranties (merchantability, fitness, non-infringement, accuracy, availability).
• Limitation of liability. To the maximum extent permitted by law: (a) Tanqory is not liable for indirect, consequential, incidental, special, punitive damages, or lost profits; (b) Tanqory’s total liability is capped at the fees you paid for API access in the 3–6 months preceding the claim (or as specified in your Order Form/contract). Some jurisdictions do not allow certain exclusions—apply the maximum permitted.
• Indemnity. You will defend, indemnify, and hold Tanqory harmless from third-party claims/losses arising from your apps, data use/misuse, violations of these terms or law, or content derived from the APIs. Tanqory may control the defense; you will not settle without written consent.
• Waiver. To the fullest extent permitted, you waive claims arising from API use, including any similar to Cal. Civ. Code §1542, except non-waivable statutory rights.
• Insurance. High-volume/enterprise developers may be required to maintain adequate liability insurance naming Tanqory as additional insured, as specified in applicable programs/docs.
• Legal carve-outs. Nothing limits liability that cannot be limited by law (e.g., fraud, death/personal injury from gross negligence). Interpret limits to the maximum lawful extent.

6) Termination and suspension

• Term. Begins on acceptance/use of the API and continues until terminated.
• By Tanqory. Tanqory may suspend/terminate access anytime for any reason, including breach, platform/user risk, or data incidents—possibly immediate without notice.
• By you. You may stop using the API and notify Tanqory; licenses end when you stop calls/delete your account. Outstanding obligations survive.
• Effect. All rights/licenses end; stop using APIs; delete confidential info, keys, docs/code; do not access post-termination. Surviving terms remain in force.
• Suspension. Temporary suspension for investigation/preventing harm does not waive termination rights.
• Reinstatement. Possible after remediation, subject to corrective plan/evidence.
• API withdrawal. Tanqory may modify or discontinue APIs; if discontinued, this agreement ends when the API is shut down (notice typically provided).
• Data deletion/return. Unless legally required to retain, you must delete/return API-derived data and confirm deletion within 30 days of termination (or per DPA/contract). Legally retained data must be protected and access-limited.

7) Intellectual property

• Tanqory IP. Tanqory and its licensors retain all rights in APIs, documentation, developer portal, technology, trademarks, and related content. No ownership transfers; only a limited, revocable license is granted.
• Your IP. You retain rights in your app/code. Tanqory does not claim ownership, but API use grants Tanqory a non-exclusive, worldwide, royalty-free right to use data/content you submit via APIs to provide/improve services consistent with privacy laws.
• Developer data/content license. Tanqory may use/store/transmit your submitted data/content solely to provide the API, under a non-exclusive, worldwide, royalty-free license as necessary.
• Open source. OSS components remain under their licenses; those terms govern those components.
• Your code. Code you write to call the APIs is yours; you may open-source it, but never expose Tanqory keys/secrets or confidential docs.
• Feedback. Feedback/ideas may be used by Tanqory without compensation under a perpetual, irrevocable, sublicensable, worldwide license.
• Third-party IP. You must have rights to third-party content/data you send via APIs; Tanqory is not liable for your infringement.
• IP protection. Do not remove/obscure copyright/trademark/rights notices in API outputs. Use “Powered by Tanqory” branding as permitted; report IP/trademark infringements promptly.

8) Governing law and other terms

• Governing law. Laws of Singapore.
• Jurisdiction/venue. Unresolved disputes go to SIAC arbitration in Singapore (English). You consent to that forum and waive inconvenient-forum objections unless consumer law bars such waiver.
• Injunctive relief. IP breaches or unauthorized API use may justify injunctive relief.
• Changes to terms. Tanqory may modify terms and will notify via developer site/email/notice; continued use = acceptance. If you disagree, stop using APIs.
• No waiver. Failure to enforce is not a future waiver.
• Severability. Unenforceable terms do not affect the remainder; interpret to reflect original intent.
• Entire agreement. These terms plus referenced docs (guidelines, Privacy Policy, appendices/DPA) are the entire agreement and supersede prior communications; your additional terms are void unless Tanqory signs in writing.
• Assignment. You may not assign without written consent; Tanqory may assign in restructurings/mergers/asset sales or as allowed by law.
• Relationship. Independent contractors; no partnership/agency/employment.
• No third-party beneficiaries. Only you and Tanqory benefit unless expressly stated.
• Force majeure. Tanqory is not liable for failures due to force majeure (natural events, government actions, war, labor issues, network outages, etc.).
• Notices. Tanqory may notify via email or developer portal; maintain accurate contact info. Legal notices go to registered address/legal dept.

Appendices: jurisdiction-specific terms

These appendices are part of the terms and apply when you/your API use is subject to the cited laws. If conflicts arise, the appendix controls for that topic.

• Appendix 1 – EU/EEA/UK. Data protection appendix (GDPR) treating Tanqory as Processor for EU/EEA/UK data, includes Art.28 obligations, data-subject rights, breach notice, SCCs, EU representative (if needed), and dispute resolution as required.
• Appendix 2 – United States (incl. California). CCPA/CPRA/state-law compliance; Tanqory is a “service provider,” no sale/share except as permitted; may include HIPAA/BAA, export controls (EAR/ITAR), and U.S. dispute terms (e.g., arbitration/class waiver if specified).
• Appendix 3 – Canada. PIPEDA/provincial compliance, cross-border transfer consent, CASL for email/SMS if applicable.
• Appendix 4 – China. PIPL/cybersecurity-law compliance, consent/language/local storage requirements, government request handling, official Chinese text if required, export assessments.
• Appendix 5 – Japan. APPI compliance, overseas transfer rules, specified personal data handling, and consumer protections under Japanese law.
• Appendix 6 – India. DPDP/IT Act compliance; data localization if applicable; remedies/liability per Indian law.
• Additional regions. Tanqory may add appendices for other locales (Australia, Brazil LGPD, Singapore PDPA, Russia, Korea, etc.) where local rules require.