Skip to content
Vendrix
Sign in

Vendrix Developer Agreement

This draft will be reviewed by counsel before it is published. Questions: support@vendrix.net.

This Developer Agreement ("Agreement") is between Vendrix ("Vendrix", "we", "us") and the natural or legal person who accepts it ("Developer", "you"). It governs access to the Vendrix public developer platform: the API at the public base URL shown in the developer console (the "API"), the developer console, the documentation, sandbox mode, API keys and webhook endpoints (together, the "Platform").

By creating a live API key, you accept the version of this Agreement shown at that moment. The console records your acceptance per user and per version. A new version takes effect on the date we publish it with prior notice under section 12.

1. Relationship to workspace Terms

The Platform operates inside a Vendrix workspace. Every API key belongs to an application that belongs to a workspace, and acts only on that workspace's own data and connected WhatsApp numbers. The business that owns the workspace is bound by the main Vendrix Terms of Service; this Agreement adds the developer-specific rules. If the two conflict for Platform use, this Agreement controls.

2. Licence to use the API

We grant you a limited, non-exclusive, non-transferable, revocable licence to access and use the API during the term of this Agreement, only:

  • through credentials issued by the Platform, with the permissions ("scopes") granted to the key;
  • in the environment the application declares (sandbox for testing, live for production traffic);
  • for lawful purposes and in compliance with the API Acceptable Use Policy and Meta's WhatsApp Business Policy;
  • within the documented rate limits and the workspace's daily send cap.

The API reference in the documentation defines the only supported calls. Access to internal endpoints or other customers' data is prohibited.

3. Your duties

You must:

  • Keep API keys and webhook signing secrets confidential. Secrets are shown once; you are responsible for storing them. You must not share, publish or embed them in client-side code or public repositories.
  • Verify webhook signatures (Vendrix-Signature, HMAC-SHA256 over event-id.timestamp.body, five-minute timestamp tolerance, both signatures during a rotation) before trusting an event.
  • Send messages only to recipients who have given the business the opt-in required by WhatsApp's Business Messaging Policy, and honour their opt-outs.
  • Keep your webhook endpoints reachable over public HTTPS on port 443 and not resolve them to private addresses.
  • Report a security incident affecting your use of the Platform (a leaked key, a compromised endpoint) to us within 72 hours of becoming aware of it, using the contact above.
  • Not misrepresent who you are or which application is calling.

4. Environment rules

Sandbox applications only read fixed fake data and send synthetic events; they never contact WhatsApp or reach real customers, and they may not be used for production traffic. Live applications act on the workspace's real connections and must be operated only by a member with the owner or admin role. You must not use the sandbox to probe the platform, and you must not present sandbox results as production behaviour.

5. Fees

The Platform is offered at no charge in this milestone. We may introduce fees later; paid use would then be governed by additional terms published in advance, not by retroactive application of this Agreement.

6. Our rights and limits

We may:

  • enforce rate limits, send caps and scope restrictions;
  • suspend an application or key (status: suspended, revoked) for a breach, a security risk, or an unlawful use, and notify the workspace;
  • change the API in ways documented in advance (versions, deprecations, changelog), while keeping the documented error and pagination contracts stable within a version;
  • monitor logs and usage to operate, secure and bill the Platform.

We do not warrant any level of availability in this milestone. A Service Level Agreement is reserved for later.

7. Data

The API exposes only the data of the workspace it is scoped to. Webhook payloads and request logs are retained per our retention policy (30 days for logs and event deliveries, see retention.md). The Developer Data Use Rules (developer-data-use.md) are part of this Agreement: for data you retrieve through the API, you act as a separate controller for your own processing; Vendrix remains responsible for the data inside the workspace. You must delete your copies when the workspace owner asks or when your access ends.

8. Confidentiality

Non-public information you access through the Platform (key material, webhook secrets, unpublished API details) is confidential. You may share it only with staff who need it to operate your application, under equivalent duties.

9. Intellectual property

The Platform, documentation and marks belong to Vendrix. Your applications and integrations belong to you. No licence is granted to use Vendrix marks in your branding except to describe that your application integrates with Vendrix.

10. Term and termination

This Agreement starts when you first accept it and runs until terminated. Either party may end it at any time: you by revoking your keys and stopping use; we may suspend or terminate for breach immediately, or for convenience with 30 days' notice. On termination, all keys are revoked, endpoints are disabled, and sections 3, 4, 7, 8, 9, 11 and 13 survive.

11. Disclaimers and liability

The Platform is provided "as is" in this milestone. To the extent the law allows, we disclaim implied warranties and are not liable for indirect, consequential or punitive damages. Our aggregate liability for Platform use is capped at [CAP — owner decision O-6, e.g. the fees paid in the last 3 months, or a fixed amount while no fees exist]. Nothing limits liability for wilful misconduct or for what the law does not allow to be limited.

12. Changes and notices

We may update this Agreement. We will announce a new version in the console at least [NOTICE PERIOD — e.g. 30 days] before it applies to new keys, and the consent checkbox will ask again only when the version changes. Continuing to create keys after the new version applies means accepting it.

13. Governing law and venue

This agreement is governed by the laws of the Republic of Cameroon, and the competent courts of Douala, Cameroon have jurisdiction over any dispute about it. [Counsel to confirm this choice before publication: it is a proposed default, not an advice.]