Developer Terms

These Developer Terms apply when you use the BrandedMark developer surfaces:

• the public API and its API keys;
• outbound webhooks;
• our command-line tools;
• any SDKs, packages, sample code, documentation or MCP access we make available (together, the "Developer Services").

They are between you and Branded Mark Limited (company number 14452041, registered in England and Wales) ("BrandedMark", "we", "us").

#Developer quick rules

Not part of the terms: a summary only.

1. Use the Developer Services only for a BrandedMark customer who has authorised you, and only within the scopes they granted.
2. Keep keys secret. Rotate them if exposed. Tell [email protected] within 24 hours of any incident.
3. Don't use customer data from our API to train AI models, except for that customer's own integration with its consent.
4. Don't scrape, simulate users with bots, or work around rate limits or security.
5. AI agents act for a named human, within that person's permissions. Refunds, deletions, warranty decisions and other high-impact actions need human confirmation.
6. Verify webhook signatures. Expect retries.
7. Say "works with BrandedMark", never "by BrandedMark" or "official".
8. Breaking changes come with 6 months' notice (90 days for preview or beta). Security fixes may take effect immediately.
9. Need the API or tools to work differently? Don't work around them. Tell us at [email protected]. Your feedback shapes what we build.

#1. Acceptance and how these terms fit

1.1 You accept these terms by creating or using an API key or other credential, installing the developer tools, or calling the API. If you act for an organisation, you confirm you can bind it.

1.2 Customers. If you are a BrandedMark customer (or its employee or contractor), your use is also governed by your Customer Agreement (Customer Terms, DPA, AUP). Where they conflict, the Customer Agreement prevails, except that clauses 5 and 6 of these terms apply in addition.

1.3 Third-party developers. If you build for a customer but are not one yourself, these terms govern your relationship with us. The customer is responsible to us for your activity in its tenant.

1.4 Developer tools licence. Our command-line tools, SDKs and packages are proprietary software. They are licensed under the BrandedMark Developer Tools Licence that comes with them. That licence and these terms apply together.

1.5 Business use and sanctions. The Developer Services are for business use only. You must not use them if you are a person subject to UK or EU sanctions, or if you are located in, or acting for anyone in, a country or region subject to comprehensive UK or EU sanctions.

#2. Credentials and access

2.1 API keys.

• API keys are created by a user of a customer tenant who has permission to manage integrations. Each key is limited to the public-API scopes chosen when it is created. We may limit the number of keys a tenant can hold.
• We can't show a key again after it is created.
• Our command-line tools sign in through your browser. Depending on the tool, they then store either an API key for that machine, which you can revoke, or a sign-in token that expires if it isn't used.

2.1A Registered applications. If you build an application for more than one customer, register it with us where we offer registration. Customers then connect it by approving the access it asks for, and you don't need their API keys. When you register an application:

• give accurate details: your organisation, a contact, the application's purpose and a link to its privacy policy;
• request only the scopes the application needs;
• keep your client credentials secret, as clause 2.2 requires.

We may review, decline, suspend or remove an application. Each customer can see the applications connected to its tenant and disconnect them at any time.

2.2 Keep credentials confidential:

• don't embed them in client-side code or public repositories;
• don't share them between customers;
• rotate them promptly if they may have been exposed.

2.3 You are responsible for all activity using credentials issued to you or your customer for your integration.

2.4 Authorisation. You may access a customer's data only:

• with that customer's authorisation;
• within the scopes it granted; and
• for the purpose it approved.

When the customer revokes access, you must stop using the data and delete it in line with clause 4.

#3. Fair use and limits

3.1 We apply rate limits and quotas to protect the service, and we may change them. When you exceed a limit, the API returns a 429 response. Design your integration to back off when it gets one.

3.2 You must not:

• circumvent limits;
• spread load across keys or tenants to evade them; or
• run load or security tests against the service (security research is welcome under our Responsible Disclosure Policy).

#4. Data handling

4.1 Treat data you receive through the Developer Services as the customer's confidential data. Use it only to provide the integration the customer asked for.

4.2 You must:

• (a) protect the data with appropriate technical and organisational measures, at least encryption in transit, access control and least privilege;
• (b) collect and keep only what the integration needs;
• (c) delete the data within 30 days after the customer revokes access or asks you to, unless the law requires you to keep it;
• (d) comply with data protection law (UK GDPR, EU GDPR). Where you process personal data for the customer, you act as its processor or sub-processor under your own contract with it.

4.3 You must not:

• (a) sell, rent, broker or share the data with anyone except as the customer directs;
• (b) use data obtained through the Developer Services to train, fine-tune, adapt, evaluate or otherwise improve any artificial intelligence or machine learning model, including through retrieval indexes built for that purpose, except a model used solely for that customer's own integration and with its documented consent;
• (c) combine data from different customers;
• (d) re-identify de-identified data.

#5. AI agents and MCP

5.1 Scope. This section applies to any AI agent or MCP client you connect to the Developer Services, and to any MCP access we make available. MCP servers you connect to the AI agent inside the Service are your own integrations, governed by the Customer Agreement.

5.2 Agents act for a named human. An AI agent may act only:

• for an identified user or organisation that authorised it;
• within that principal's granted scopes; and
• never with broader rights than the human would have.

5.3 Human confirmation for high-impact actions. You must build in explicit human confirmation before an agent:

• issues refunds or credits;
• approves or rejects a warranty claim;
• deletes records or exports personal data;
• changes access rights;
• sends communications to consumers in bulk; or
• signs or seals records.

5.4 Logging and accountability. Keep a log of agent actions: who authorised them, what they did, and when. Make it available to the customer. You remain responsible for what your agent does.

5.5 Prompt injection. Content in the platform (case messages, product data, uploads) may contain instructions. You are responsible for making your agent resilient to them. Don't let content from our API change your agent's permissions or goals.

5.6 Our AI features. You must not:

• attempt to extract, reconstruct or reveal our system prompts, tools, model configuration or training approach;
• jailbreak or prompt-inject our AI features; or
• systematically capture their behaviour to build a competing model or service (see clause 6(c)).

#6. Prohibited uses

You must not, and must not help anyone else to:

• (a) reverse engineer, decompile, disassemble or derive the source code, models, prompts, workflows, data structures or user interface of the Service. The only exception is where the law expressly permits it and cannot be excluded (for example observing, studying or testing under CDPA s.50BA, or decompilation for interoperability under s.50B). Even then, tell us first;
• (b) use AI or automated tools to analyse, reconstruct, replicate or extract the Service's code, prompts, models, workflows, data structures, documentation or user interface. This includes feeding screenshots, responses, HTML or traffic into a model to clone features;
• (c) systematically capture the behaviour of our AI features (their prompts, instructions or models), or generate synthetic training data from them, to train or distil a model that competes with the Service (model distillation). This does not limit a customer's use of its own Customer Data, including AI Output;
• (d) scrape, crawl or harvest the Service, consumer portals, resolvers or passports, except normal search-engine indexing of public pages;
• (e) use bots, headless browsers or browser extensions that simulate users, or that bypass authentication, rate limits, CAPTCHAs or security controls;
• (f) build a product that substantially replicates the Service, using access to the Developer Services;
• (g) publish benchmarks or performance tests of the Service without our written consent;
• (h) misrepresent your relationship with us.

6A. Commerce integrations. If your app processes orders, payments, tax, shipping or seller onboarding: (a) you must not present your app or BrandedMark as the seller or merchant of record; (b) you must not route purchaser payments through any account the Brand has not authorised; (c) you must not change tax calculations or Storefront terms except as the Brand configures them; (d) any tax features in your app are your responsibility, and you must not describe them as tax advice; and (e) you are responsible for any platform-reporting, marketplace or facilitator obligation your app itself creates.

#7. Webhooks

• Verify the X-BrandedMark-Signature header (an HMAC-SHA256 signature with a timestamp) on every webhook we send you.
• Reject stale or unsigned requests.
• Expect duplicates and retries. We retry failed deliveries for a limited period.
• Make your handlers idempotent.
• Keep your endpoint secret confidential.

#8. Branding

• You may say your integration "works with BrandedMark" or "connects to BrandedMark".
• You may not:
  • use "BrandedMark" (or "Branded" on its own) in your product name, logo or domain;
  • imply endorsement or certification; or
  • alter our marks.
• Follow any brand guidelines we publish. Our trade mark BRANDEDMARK is registered in the UK (UK00004378778).

#9. Changes and deprecation

9.1 Additive changes, any time. We may add to the Developer Services at any time without notice. For example, we may add new endpoints, optional fields, response fields or webhook event types. Build your integration to ignore fields and event types it doesn't recognise.

9.2 Breaking changes and retirement: notice first. A change is breaking if it removes or renames something, or changes behaviour in a way that would stop a correctly built integration from working. Before one, we give at least:

• 6 months' notice for generally available endpoints and tools; and
• 90 days' notice for preview or beta ones.

9.3 Security and urgent changes: sooner, or immediately. We may make a change sooner than clause 9.2 allows, including straight away, where it is needed to:

• fix a security vulnerability, or protect the Service, our customers or consumers;
• comply with the law or an order from a regulator; or
• respond to a change by a third party we rely on, if that change is outside our control.

In that case we'll tell you as soon as we reasonably can, and we'll keep the disruption as small as we can.

9.4 How we tell you. We tell you about breaking changes and retirements by email to the tenant's administrators. Where we publish developer documentation or a changelog, we announce them there too.

9.5 Changes to these terms. We may update these terms on 30 days' notice. If you continue to use the Developer Services after that date, you accept the update.

9.6 Feedback. If you need the Developer Services to work differently, tell us through support ([email protected]) rather than working around them. We may use your suggestions freely, with no obligation to you.

#10. Monitoring, audit and security incidents

10.1 We monitor use of the Developer Services to keep them secure and enforce these terms.

10.2 On reasonable request, no more than once a year unless we reasonably suspect a breach, you'll give us written information about how you handle data obtained through the Developer Services.

10.3 Tell [email protected] within 24 hours of becoming aware of any security incident affecting credentials or data obtained through the Developer Services. Cooperate with us and the affected customer.

#11. Suspension and termination

11.1 We may suspend or revoke credentials immediately if we reasonably believe there is:

• a security risk;
• a breach of clauses 4–6; or
• harm to customers or the Service.

We'll tell you why, unless the law or security prevents it.

11.2 Either party may stop using or providing the Developer Services at any time. For customers, the Customer Agreement governs termination of the subscription.

11.3 On termination, stop using the Developer Services and delete the data as clause 4.2(c) requires.

#12. Fees

The Developer Services are currently free to use for authorised integrations. We may introduce fees or paid tiers on 60 days' notice. Existing paid commitments are governed by their Order Forms.

#13. Warranties and liability

13.1 The Developer Services, the documentation and the sample code are provided "as is" and "as available". We give no warranty that they will be uninterrupted, error-free or fit for a particular purpose, except as set out in a customer's Customer Agreement.

13.2 Customers. Our liability is governed by the Customer Agreement.

13.3 Third-party developers. Our total liability under these terms is limited to the greater of:

• (a) the fees you paid us for the Developer Services in the 12 months before the claim; and
• (b) £1,000.

13.4 Neither party excludes liability that cannot be excluded by law, including for death or personal injury caused by negligence, or fraud.

#14. Indemnity

You will indemnify us against third-party claims and regulatory fines to the extent caused by:

• your breach of clauses 4–6; or
• your integration's misuse of customer data.

We will:

• tell you promptly about any such claim;
• let you control its defence; and
• cooperate reasonably, at your cost.

#15. General

• These terms are governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction.
• Nothing in these terms creates a partnership or agency.
• You may not assign these terms without our consent.
• If any provision is invalid, the rest remains in force.

#Version history