Developer Privacy Addendum

1. Scope and how this relates to the AskBiz Privacy Policy

This Developer Privacy Addendum supplements the AskBiz Privacy Policy and covers processing that’s specific to developer.askbiz.co and the /api/v1/* API — things the main Privacy Policy doesn’t need to describe because they only exist for developers. A developer account runs on the same underlying AskBiz account system as the rest of the platform, so the main Privacy Policy’s sections on legal bases, international transfers, security, sub-processors, and your rights all apply here too — this page adds the API-specific detail on top of them rather than restating them.

2. Who this page is about

There are three distinct people whose data can flow through the API, and this addendum treats them differently:

• You, the developer — the account holder who registers for API keys. Section 3 covers what we collect about you.
• A Merchant — an AskBiz business whose data your Application can access, but only what they explicitly grant through a real consent screen. Section 5 covers this.
• A Merchant’s own customers or staff — end users who never interact with AskBiz directly in this flow. We don’t have a direct relationship with them; if your Application processes their personal data via API responses, you do, as covered in Section 12.

3. Data we collect about you as a developer

Account data. The phone number and PIN, or email, you register with — the same account fields described in the main Privacy Policy, since developer accounts use the same authentication system as the rest of AskBiz.

API usage data. For every API call: the endpoint, timestamp, latency, HTTP status, a request ID, and, for billed endpoints, the amount debited. Where you send an Idempotency-Key, we store the key alongside a snapshot of the response so a retry can be replayed — see Authentication. This data is the basis for your Usage dashboard, for rate-limit and quota enforcement, and for billing records.

Content you send us. The body of each request — for example, the text of a question sent to /api/v1/ask, an image sent to /api/v1/scan, or a phone number and message text sent to /api/v1/whatsapp/send. See Sections 6 and 7 for how these are specifically handled.

App metadata. If you create an App to group your keys, its name, logo URL, and redirect URI — shown to a Merchant on the consent screen so they know who’s asking.

Webhook configuration. Destination URLs and signing secrets you configure for event delivery, plus a delivery log (status, attempts, timestamps) for events sent to them.

Billing data. Your credit balance and top-up history. Card details are handled directly by Stripe — we don’t store your card number.

4. How we use it

• To operate the API — authenticate your requests, enforce rate limits and quotas, and return responses.
• To bill you accurately — only for successful calls, replaying an idempotent retry instead of double-charging.
• To detect and prevent abuse — for example, identifying traffic patterns that violate the Developer API Terms or threaten platform stability for other developers.
• To provide support when you contact us about your integration.
• To meet legal and accounting obligations, including retaining transaction records for as long as required by law.

5. Data from merchant connections

POST /api/v1/connections is the one place the API exposes another person’s business data to you, and it only does so within limits a Merchant actively agrees to:

• A Connection only exists once the Merchant approves it on AskBiz’s own hosted consent page, which shows them exactly which Scopes you’re requesting.
• You only ever receive data within the Scopes actually granted — for example, read_inventory is what unlocks the merchant_id parameter on /api/v1/scan, and grants nothing beyond inventory read access.
• A Merchant can revoke a Connection at any time from their own account, at which point we stop granting your key any further access under it.
• We log Connection creation and revocation events so a Merchant can see what’s connected to their account and when.

We are a processor of the Merchant’s data in this flow, acting on the access instructions the Merchant themselves set via the consent screen — not a party deciding on your behalf what you should be allowed to see.

6. Images sent to the vision endpoint

A photo you submit to /api/v1/scan is processed to generate a product-match result and, for an account-mode key, matched against the connected business’s own inventory. This is the same underlying vision pipeline AskBiz’s own camera features use — see the camera and photo data section of the AskBiz Privacy Policy for how images are processed and retained; the same handling applies regardless of whether the photo originates in the AskBiz app or from a third-party Application calling the API on a Merchant’s behalf.

7. WhatsApp messages

/api/v1/whatsapp/send sends a pre-approved template through AskBiz’s own Meta Business API connection. The recipient phone number and message content pass through Meta’s WhatsApp Business Platform as part of delivering the message — Meta processes this data under its own terms as the messaging infrastructure provider. Only send a message to a recipient who has consented to receive it; see Section 5 of the Developer API Terms.

8. Sub-processors specific to the API

In addition to the sub-processors listed in the main AskBiz Privacy Policy, API traffic specifically involves:

• Stripe — card processing for wallet top-ups and for Merchant payments collected through /api/v1/charges.
• Meta (WhatsApp Business Platform) — message delivery for /api/v1/whatsapp/send.
• Groq — inference infrastructure used to process /api/v1/ask requests.
• Supabase — the database underlying API keys, usage logs, Connections, and webhook configuration.

9. Retention

General retention periods are in the data retention table of the AskBiz Privacy Policy. Specific to the API: usage and billing records (Section 3) are kept for as long as needed for billing accuracy, dispute resolution, and legal/ accounting requirements, even after you stop using a key. An idempotency response snapshot is kept against its key/idempotency-key pair with no automatic expiry today — don’t reuse an idempotency key value across logically different requests, since a stored snapshot will be replayed indefinitely for that exact key value (see Developer API Terms, Section 10).

10. International transfers

Data may be processed in a different country than the one you or a Merchant are in, using the same safeguards described in the international transfers section of the AskBiz Privacy Policy.

11. Your rights

You have the same rights over your developer account’s personal data as any AskBiz account holder — access, correction, and deletion — described in the main AskBiz Privacy Policy. To exercise them, email privacy@askbiz.co. Note that deleting your account doesn’t retroactively delete usage and billing records we’re required to keep for accounting or legal reasons, and doesn’t revoke Merchant Connections on your behalf — disable your keys first so any integration relying on them stops cleanly.

12. Your responsibilities as a developer

If your Application collects, stores, or otherwise processes personal data — your end users’ data, or a Merchant’s customer data obtained through a Connection — you are the controller (or processor, as the case may be) for that processing, not AskBiz. That means:

• You need your own lawful basis for processing that data, and your own privacy notice describing it to the people it belongs to.
• You may not represent AskBiz’s Privacy Policy or this addendum as covering your Application’s own data practices.
• If you process EU/UK personal data as a processor on behalf of a Merchant, a data processing agreement is available at askbiz.co/dpa for the AskBiz-to-you leg of that chain; you’re responsible for having your own equivalent agreement with the Merchant.

13. Security

API traffic runs over TLS. Keys are shown once in full at creation and stored hashed thereafter — if you lose a key, you can’t retrieve it, only disable it and issue a new one. General security measures are described in the AskBiz Privacy Policy. If you discover a security vulnerability in the API, report it to privacy@askbiz.co rather than testing it against a real Merchant’s data.

14. Children’s data

The developer platform is a business-to-business surface and isn’t directed at children. Don’t use the API to knowingly collect personal data from children.

15. Changes to this addendum

We may update this addendum from time to time; the “last updated” date at the top reflects the current version, and a material change will be noted in the Changelog.

Privacy questions: privacy@askbiz.co
Support: hello@askbiz.co