Embed API Terms of Access

1 Definitions

API means Embed's application programming interfaces, SDKs, client libraries, webhooks, developer tools, executable applications, and integration materials.

API Credentials means API keys, tokens, client IDs, secrets, certificates, or other authentication credentials issued or approved by Embed.

Application means Developer's software, integration, service, plugin, or solution that uses an API or connects to the Embed Services.

Cloud Deployment means an API hosted and operated by Embed or its infrastructure providers.

On-Premise Deployment means API components installed or operated in Developer's or a Customer's infrastructure with Embed's written authorisation.

Hybrid Deployment means a combination of Cloud Deployment and On-Premise Deployment.

Customer means an end user or entity with a valid agreement to use Embed Services.

Confidential Information means non-public information disclosed by one party to the other, including API specifications, credentials, source code, algorithms, business plans, pricing, Customer data, security configurations, and technical architecture. API Credentials are always Confidential Information.

Data Protection Laws means applicable privacy, data protection, and information-security laws, including the GDPR, UK GDPR, CCPA/CPRA, and equivalent laws that apply to processing under this Agreement.

Documentation means Embed's applicable technical documentation, specifications, integration guides, policies, and security requirements.

Embed Marks means Embed's names, logos, trade marks, service marks and other brand identifiers.

Embed Services means Embed's products, platforms, and services.

Personal Data has the meaning given under applicable Data Protection Laws.

Rate Limits means the API request or transaction limits stated in the Documentation or otherwise communicated by Embed.

Service Data means data processed, transmitted, stored, or generated through the APIs or Embed Services, including Customer data and operational data.

Beta Service means an API, feature, or functionality marked beta, preview, early access, experimental, or similar.

Sandbox means a non-production environment for development and testing using test or synthetic data.

2 Access and Licence

2.1 API licence

Subject to this Agreement, Embed grants Developer a limited, non-exclusive, non-transferable, non-sublicensable, revocable, worldwide licence to:

• access and use the APIs solely to develop, test, and operate Applications that integrate with Embed Services;
• use the Documentation as necessary for that purpose; and
• reproduce and distribute Embed-provided client libraries only as incorporated into Applications.

All rights not expressly granted are reserved by Embed.

2.2 Deployment models

For an On-Premise Deployment, Developer may install and operate only the API components, environments and infrastructure expressly authorised by Embed in writing. Embed is responsible for any infrastructure supplied and controlled by Embed. Developer is responsible for infrastructure under its control, including its hardware, operating systems, networks, access controls, physical security, patching, backups and disaster recovery. Developer must not copy, relocate or migrate Embed API components without Embed's written approval. Embed retains ownership of all Embed API components and may verify deployment configurations on reasonable notice.

For a Cloud Deployment, Developer may use only the endpoints, protocols and methods in the Documentation. Embed has sole discretion to determine the countries and regions in which Service Data is hosted, processed, stored, replicated, backed up, accessed, supported or transferred. Embed may change those locations, its infrastructure, hosting providers and sub-processors at any time. Developer and each Customer have no consent, approval, consultation or veto right in relation to any such selection or change. Any exception requiring Service Data to be hosted, processed or stored in a particular country or region is binding only if set out in a separate written amendment to this Agreement that expressly overrides this section and is digitally signed by authorised representatives of both parties. Embed will comply with mandatory Data Protection Laws and implement any lawful transfer mechanism or other safeguard required by those laws.

For a Hybrid Deployment, the On-Premise rules apply to on-premise components and the Cloud Deployment rules apply to cloud components. Developer must maintain secure, encrypted connectivity between components under its control. Data processing, storage and transfer requirements apply separately to each component based on its location and control.

2.3 Sandbox and beta services

A Sandbox may be used only for development and testing with test or synthetic data. Embed may reset, purge, modify, or discontinue Sandbox data or configurations at any time. Sandboxes are not subject to the SLA.

Beta Services are provided "as is" for evaluation only. They are not subject to the SLA, support commitments, or API-version notice periods. Embed may change, limit, or discontinue a Beta Service at any time. Developer must not use a Beta Service in production unless Embed has authorised that use in writing, and any permitted production use is at Developer's own risk.

2.4 Exclusions

The licence does not grant Developer any right to use Embed Marks, access source code, sublicense, resell, redistribute API access, or access Embed Services beyond those expressly authorised.

3 Developer Responsibilities

Developer must:

• comply with this Agreement, the Documentation, and applicable law;
• maintain all licences, permissions, and consents required for its Applications;
• ensure its Applications do not infringe third-party rights or contain malicious code;
• support its own end users;
• maintain appropriate error handling, logging, retry mechanisms, and current technical contacts; and
• comply with Schedule A.

Developer must not, and must not allow any third party to:

• reverse engineer, decompile, disassemble, or attempt to derive source code or algorithms from the APIs or Embed Services;
• bypass security controls, authentication, Rate Limits, licensing restrictions, or intended API functionality;
• probe, scan, penetration-test or otherwise test the security or vulnerability of the APIs, Embed Services, systems or cloud infrastructure without Embed's prior written approval;
• share API Credentials between Applications, environments or unrelated authorised users except as expressly permitted in the Documentation;
• use scraping, direct database access, or other non-API methods to circumvent API restrictions;
• resell, repackage, or redistribute the APIs, Service Data, or Embed Services without Embed's written approval;
• use the APIs for unlawful activity, including fraud, spam, harassment, or unlawful data collection;
• introduce malicious code or impair Embed systems;
• access unauthorised endpoints, data, or functionality;
• disclose non-public benchmarks, comparative tests, or performance analyses without Embed's written consent, except for reasonable internal operational monitoring; or
• develop or operate a service primarily intended to replicate or replace the APIs or Embed Services.

Developer must not create or process fictitious or misleading transactions, bookings, reservations, loyalty activity, customer records, operational events, analytics, or reporting. It must not manipulate business rules, entitlements, promotions, billing, auditing, security monitoring, or reporting, nor run production load, stress, or denial-of-service tests without Embed's written approval.

3.1 Rate limits and integrations

Developer must comply with Rate Limits. Embed may throttle, restrict, or suspend access for excessive or harmful use. Requests for higher limits require Embed's prior written approval and may involve additional fees.

Developer must provide end users with accurate terms and privacy notices, obtain required consents, use only the data necessary for its Application, and keep its Application compatible with supported API versions.

Where Developer receives webhooks, it must use a publicly reachable HTTPS endpoint, verify each delivery using Embed's specified signature method, process duplicate or out-of-order events safely, and respond within the Documentation's stated timeframe.

For state-changing requests identified in the Documentation, Developer must use a unique idempotency key. Embed is not responsible for duplicates caused by Developer's failure to supply or properly manage those keys.

4 Credentials and Security

Embed may issue API Credentials after registration, vetting, and any required security assessment. Separate credentials may be issued for development, staging, and production.

Developer must protect Credentials, not expose them in client-side code or public repositories, store them using appropriate encryption and secrets-management practices, rotate them at least annually or as Embed requires, and notify Embed immediately of loss, compromise, or unauthorised disclosure. Developer must promptly revoke and replace compromised Credentials.

Developer must implement enhanced authentication required by Embed, such as mutual TLS, certificate pinning, or multi-factor authentication. Embed may revoke, rotate, or change Credentials where it reasonably believes they are compromised or misused.

Developer must maintain security measures appropriate to the data and risks involved, including:

• TLS 1.2 or higher for API communications;
• encryption at rest for stored Service Data using AES-256 or an equivalent standard;
• least-privilege, role-based access controls;
• audit logs of API access retained for at least 12 months;
• vulnerability scanning, patching, and an incident-response plan; and
• appropriate network security, including firewalls and segmentation.

For On-Premise deployments, Developer must also provide physical security, required system segregation, timely patches, backups, and disaster recovery.

Embed may assess Developer's Application and integration security on at least seven business days' notice, except for suspected breaches or urgent security concerns. Developer must cooperate and remediate identified issues within the following timeframes after notification by Embed, unless Embed specifies a shorter timeframe where reasonably required to address an imminent risk: Critical, 48 hours; High, 7 days; Medium, 30 days; and Low, 90 days.

Developer must promptly report actual or suspected vulnerabilities affecting the APIs, Credentials, Service Data, or connected systems and must not publicly disclose or exploit them without Embed's written consent.

Developer must notify Embed within 24 hours of discovering an actual or reasonably suspected security incident affecting Credentials, Service Data, or systems connected to the APIs, including any unauthorised access, use, disclosure, alteration, loss or destruction of Service Data. It must contain and remediate the incident, provide requested information and material updates, and deliver a written post-incident report within 72 hours after containment.

Embed may suspend or restrict API access during an actual or reasonably suspected security incident where Embed reasonably considers this necessary to protect the APIs, Embed Services, Service Data, Customers or other users.

5 Data Protection

Where Developer processes Personal Data through the APIs on behalf of Embed or a Customer, Developer acts as a processor and must process it only on documented instructions. Where Developer determines the purposes and means of processing for its own purposes, it acts as an independent controller and is responsible for its controller obligations.

The parties will enter into a data processing agreement where required. Developer must comply with Data Protection Laws, implement appropriate technical and organisational measures, assist with data-subject requests where applicable, maintain required records, and make compliance information available to Embed.

Developer must not transfer Personal Data outside an applicable jurisdiction unless Developer has implemented any lawful transfer mechanism or safeguard required by Data Protection Laws. This restriction applies to Developer's processing and does not limit Embed's right to select or change its processing and hosting locations. Developer must not sell, share for advertising, monetise or use Service Data beyond operating its authorised Application.

Embed has sole discretion to determine where Service Data is processed, hosted, stored, replicated, backed up, accessed, supported and transferred, and may use any country or region selected by Embed or its sub-processors. Embed may change those locations, providers and sub-processors at any time without the consent, approval or veto of Developer or any Customer. Developer acknowledges that Service Data, including Personal Data, may be transferred to and processed in countries other than the country in which Developer, a Customer or an individual is located. Any data-residency, data-sovereignty or data-localisation commitment is binding only if contained in a separate written amendment to this Agreement that expressly overrides this section and is digitally signed by authorised representatives of both parties. Where required by mandatory Data Protection Laws, Embed will implement an applicable lawful transfer mechanism or other required safeguard. For On-Premise Deployments, Service Data will remain within the Customer's or Developer's infrastructure except to the extent that the deployment is configured to transmit data to Embed, an Embed Service or an approved third-party service. Developer is responsible for ensuring that its own processing, storage, access and transfer of Service Data complies with applicable law.

Developer must retain only the minimum Service Data needed for its authorised purpose and securely delete or return applicable Service Data within seven days after a Customer relationship ends, an integration is removed, access expires, this Agreement terminates or expires, Embed requests it, or the data is no longer needed, unless law requires longer retention. Developer must certify deletion on request.

Where Developer is legally required to retain Service Data, Developer must continue to protect that data under this Agreement, must not use it for any other purpose, and must delete it when the relevant retention requirement ends.

Embed is responsible for Service Data only while it remains in Embed's direct control. Once data has passed the API boundary into Developer's, its sub-processors', Customers', or end users' systems, Developer is responsible for its security, integrity, confidentiality, and lawful processing, except to the extent an issue is directly caused by Embed's breach of this Agreement or its legal obligations.

Developer may not appoint sub-processors to process Service Data without Embed's prior written consent. Approved sub-processors must be bound by equivalent protections, and Developer remains responsible for them.

6 Fees

To progress to development, testing including access to UAT and final process of certification, Developer must pay the fees and charges set out in Schedule C. Progress with development will be paused until the associated developer fee is paid in full.

Access to Embed APIs involves fees that are invoiced to Embed licence holders. Embed will charge fees on a monthly basis unless Schedule C states otherwise. Subscription fees are invoiced at the start of the calendar month for that month. Fees based on metered usage are invoiced in the first week of the month, in arrears, for the previous calendar month's usage. All invoices are payable in accordance with the licensee's existing payment terms. Late payments may accrue interest at the lesser of 1.5% per month or the maximum lawful rate. Fees exclude applicable taxes.

Embed's metering records control for usage and charging purposes. Developer authorises Embed to invoice and, where a valid payment method is held, charge the applicable amounts under Schedule C. Developer must raise any usage or fee dispute within 30 days of the relevant invoice or charge, after which it is deemed accepted, except for manifest error.

7 Ownership and Branding

Embed retains all right, title, and interest in the APIs, Documentation, Embed Services, Embed Marks, and related technology, improvements, and derivative works. Developer retains ownership of its Applications, proprietary technology, and data submitted through the APIs, subject to the limited licence below.

Developer grants Embed a non-exclusive, royalty-free, worldwide licence to process, store, and transmit Developer data only as necessary to provide the APIs and perform this Agreement.

If Developer provides feedback, Embed may use it without restriction, attribution, or payment.

Developer must not use, and must not permit any third party to use, API responses, Service Data, Documentation, metadata, schemas, endpoint information, usage information, error messages or derivative datasets to train, fine-tune, benchmark, evaluate, validate, augment or improve an artificial intelligence, machine-learning, large language, foundation or similar automated model or system without Embed's prior written consent. This does not prohibit the use of general-purpose AI tools for software development where no Confidential Information, Credentials, Personal Data, or Service Data is disclosed to an unauthorised third party.

Developer must not use the APIs, Documentation or Service Data to develop or support an AI-enabled product or service intended to replicate, replace or compete with the APIs or Embed Services.

Developer may use Embed Marks only with Embed's prior written approval and in accordance with Embed's brand guidelines. Embed may use Developer's name and logo to identify Developer as an integration partner, unless Developer revokes that permission on 30 days' written notice.

8 API Changes, Support and SLA

Embed may modify, update, or discontinue APIs and Documentation. It will use reasonable efforts to notify Developer of material changes through the Developer portal, Documentation, email, in-API notices, or direct communication.

For breaking changes, Embed will normally provide at least 60 days' notice and reasonable migration guidance. It may make immediate changes where reasonably necessary for security, legal, regulatory, fraud-prevention, operational-stability, or material business reasons. Developer must migrate within the notified period; Embed may restrict or suspend access for non-conformance.

Embed may publish an API version lifecycle policy identifying supported versions, deprecation periods and end-of-life dates. Unless a shorter period is reasonably required for security, legal, regulatory, fraud-prevention or operational reasons, Embed will provide at least 60 days' notice before discontinuing a production API version.

Embed may discontinue support for an operating system, database, runtime, infrastructure component or third-party dependency that has reached vendor end-of-life, is no longer supported by its provider, or presents a material security, operational or supportability risk.

On-Premise availability is Developer's responsibility; Embed's obligations are limited to applicable software updates, patches, and reasonable technical guidance.

Embed will provide standard support which may include Documentation, Developer portal access and business-hours email assistance. Developer remains responsible for support to its own end users.

9 Confidentiality

Each party must protect the other's Confidential Information using at least reasonable care, use it only to perform or exercise rights under this Agreement, and disclose it only to personnel, contractors, and advisers who need to know it and are bound by equivalent confidentiality obligations.

Confidential Information excludes information that the receiving party can demonstrate is public through no breach, was previously known without restriction, was independently developed without use of the confidential information, or was lawfully received from a third party without restriction.

A receiving party may disclose Confidential Information when legally required, provided it gives prompt notice where permitted and reasonably cooperates to obtain protective treatment.

These obligations continue for five years after termination, except that trade secrets remain protected for as long as they qualify as trade secrets under applicable law.

10 Warranties and Liability

Developer represents that it has authority to enter this Agreement; its Applications will not infringe third-party rights or contain malicious code; it will comply with applicable law; it will protect Service Data appropriately; and information provided to Embed is accurate and current.

Embed represents that it has the right to grant the licence in this Agreement and that the APIs, as provided, do not knowingly infringe third-party intellectual-property rights.

Except for the express warranties above, the APIs, Documentation, and related materials are provided "as is" and "as available." To the maximum extent permitted by law, Embed disclaims all implied, statutory, and other warranties, including merchantability, fitness for a particular purpose, title, non-infringement, uninterrupted availability, security, error-free operation, and correction of defects.

To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, consequential, exemplary, or punitive damages, including lost profits, revenue, data, goodwill, or business interruption.

Embed's aggregate liability arising out of or relating to this Agreement will not exceed the greater of: (a) fees paid by Developer under this Agreement in the 12 months before the first event giving rise to liability; or (b) USD $2,000.00.

The exclusions and cap do not apply to liability that cannot lawfully be excluded or limited; fraud or wilful misconduct; Developer's breach of Section 9, including any unauthorised use or disclosure of Embed Confidential Information; Developer's indemnification obligations; or Developer's breach of the licence restrictions, fraudulent or abusive activity restrictions, AI-use restrictions or vulnerability-disclosure obligations.

Any claim must be brought within two years after the first event giving rise to it.

11 Indemnity and Insurance

Developer will defend, indemnify, and hold harmless Embed, its affiliates, and their personnel from third-party claims, losses, damages, costs, and reasonable legal fees arising from Developer's use of the APIs, Applications, breach of this Agreement, infringement by its Applications, legal non-compliance, unlawful Personal Data processing, or claims by its end users.

Embed will defend and indemnify Developer against third-party claims that the APIs as provided directly infringe third-party intellectual-property rights. This does not apply to claims arising from Developer modifications, combinations with non-Embed technology, or use outside this Agreement.

The indemnified party must give prompt notice, reasonable cooperation, and control of the defence to the indemnifying party. No settlement may impose obligations on the indemnified party without its prior written consent.

Developer must maintain professional indemnity/errors and omissions, cyber liability, and commercial general liability insurance of at least USD $1,000,000 per claim and in the annual aggregate, or the equivalent in local currency, and provide evidence on request. Developer must promptly notify Embed of any cancellation, non-renewal or material reduction in the required coverage.

12 Term and Termination

This Agreement starts on the Effective Date and continues until terminated in accordance with this Agreement. Either party may terminate this Agreement for convenience by giving the other party 30 days' written notice. The expiry, suspension or cessation of any particular API access, fee, service or deployment does not by itself terminate this Agreement.

Either party may terminate immediately if the other party materially breaches the Agreement and fails to cure within 30 days after notice, becomes insolvent, ceases ordinary operations, or undergoes a change of control involving the terminating party's competitor.

Embed may suspend or terminate access immediately where Developer creates an imminent security risk, breaches applicable law, fails to address compromised Credentials promptly, or where required by law or court order.

A suspension does not relieve Developer of its payment, security, confidentiality, data-protection or other continuing obligations. Embed may restore access once the relevant risk or breach has been remedied to Embed's reasonable satisfaction.

On termination or expiry, Developer must stop using the APIs, disable integrations, pay outstanding fees, and return or securely destroy Embed Confidential Information. For On-Premise Deployments, Developer must uninstall Embed API components within 30 days. Embed may delete Developer account data after a reasonable wind-down period of at least 30 days.

Developer must securely delete or return Service Data in accordance with Section 5 and certify deletion on request.

Sections that by their nature should survive, including ownership, data protection, confidentiality, disclaimers, liability, indemnities, and general terms, survive termination.

13 Audit and Compliance

Embed may monitor API use and, on at least 10 business days' notice, audit Developer's relevant records, systems, and practices during normal business hours. Audits must not unreasonably disrupt Developer's operations.

Embed will not conduct more than one routine audit in a 12-month period unless a prior audit found non-compliance or Embed reasonably suspects a breach. Developer must promptly remediate non-compliance at its expense.

The notice and routine-frequency limitations do not apply to a security assessment under Section 4 or where urgent access is reasonably required to investigate an actual or suspected security incident.

If an audit identifies material non-compliance, Developer must reimburse Embed's reasonable external audit costs.

14 General Terms

The parties will first attempt to resolve disputes through good-faith negotiation between senior representatives for 30 days. If unresolved, either party may refer the matter to mediation through the Singapore Mediation Centre before commencing formal proceedings.

This Agreement is governed by Singapore law. The courts of Singapore have non-exclusive jurisdiction, except that either party may seek injunctive relief in any court of competent jurisdiction. The CISG does not apply.

This Agreement and its Schedules constitute the entire agreement between the parties on its subject matter. A data processing agreement prevails only in relation to the processing of Personal Data. Any amendment to this Agreement must be in writing and digitally signed by authorised representatives of both parties, except that Embed may update Documentation, policies, API functionality and non-material operational terms in accordance with Section 8. No purchase order, security questionnaire, proposal, email or other document modifies this Agreement or creates any additional obligation unless it is expressly incorporated through a digitally signed amendment to this Agreement.

Developer may not assign this Agreement without Embed's prior written consent. Embed may assign it to an affiliate or in connection with a merger, acquisition, or sale of substantially all assets.

If a provision is unenforceable, it will be modified to the minimum extent necessary or severed, and the remainder will remain effective. A failure to enforce a right is not a waiver. Neither party is liable for delay or failure caused by events beyond reasonable control, provided it gives prompt notice and reasonably mitigates the impact.

The parties are independent contractors. This Agreement creates no partnership, joint venture, agency, franchise, employment relationship, or third-party beneficiary rights.

Formal notices must be in writing and sent to the email or registered address stated in the signature details or subsequently notified in writing. Email notices are deemed received upon confirmed delivery; recognised overnight courier notices on the next business day; and registered post notices five business days after posting.

This Agreement and any permitted amendment may be signed digitally or electronically, including in counterparts. Each digital or electronic signature is deemed an original and has the same legal effect as a handwritten signature. The parties consent to electronic records and delivery of the executed Agreement.

Developer must comply with applicable export-control, economic-sanctions, anti-bribery, and anti-corruption laws. Developer must not permit access to the APIs by sanctioned or restricted persons or entities.

Schedule A — Minimum Technical and Security Standards

Developer Applications must meet these minimum standards:

• Authentication: OAuth 2.0, mutual TLS, or the method specified for the relevant API.
• Transport security: TLS 1.2 minimum; TLS 1.3 recommended.
• Encryption at rest: AES-256 or equivalent.
• Secrets: appropriate secure storage; bcrypt, scrypt, or Argon2 for user passwords where applicable.
• Application security: protection against applicable OWASP Top 10 risks, input validation, secure session handling, and code review.
• Logging: audit trail of API interactions retained for at least 12 months.
• Reliability: retry logic with exponential backoff and appropriate circuit breakers.
• Webhooks: signature verification for all inbound webhook deliveries.
• Idempotency: support for idempotency keys for state-changing requests identified in the Documentation.
• Environment segregation: Production Credentials and Service Data must not be used in development or test environments unless expressly authorised by Embed.
• Compliance certifications: Any certification expressly stated in Schedule A.

Schedule B — Data Processing Agreement

Where Developer processes Personal Data on behalf of Embed or a Customer, the parties' applicable data processing agreement is incorporated into and forms part of this Agreement. If there is a conflict concerning the processing of Personal Data, the data processing agreement prevails.

Schedule C — Fees and Charges

The following fees and charging rules apply to Developer's application to become an Embed integrator.

Onboarding and certification proceed as follows:

• After submission of the enquiry form, if approved, Developer will gain access to the endpoint specifications.
• To progress further, Developer will need to share design details of the integration architecture and the high-level use cases.
• Once approved, Embed will issue Developer an invoice for USD $1,500.00.
• Only after payment in full can the integration project progress, including:
  • additional consultation time with Embed team members;
  • scheduled access to Embed UAT environments; and
  • the certification process to complete the integration project ready for production.

As detailed in Section 6 (Fees), the Embed licensee is responsible for payment in relation to the ongoing use of the APIs. Embed may calculate and apply these charges automatically using either its licensing or metering records.

All API access is charged on a monthly basis in accordance with the table below:

• Fee commencement: charges begin when credentials, access or the relevant service is enabled, unless a different trigger is stated above.
• Fee changes: Embed may change the fees in this Schedule on 30 days' written notice. Updated fees apply prospectively after the notice period.
• Automatic application: Embed may invoice or charge each applicable fee based on the charging metric stated above without further approval or documentation.
• Currency: USD