Developer and API Terms

These Developer and API Terms (the "Developer Terms") are between Vitabyte, Inc., a New York corporation with its principal office at 3525 30th Ave, Suite 306, Astoria, NY 11103 ("Vitabyte", "we", "us"), and the organization for which an API key is created (the "Customer", "you").

They govern your use of:

• Vitabyte application programming interfaces, including REST and streaming endpoints, the agentic-commerce interface and any MCP or tool interface we publish (the "APIs");
• API keys, client secrets, OAuth clients, webhook signing secrets and other credentials we issue (the "Credentials");
• software development kits, libraries, sample code and command-line tools we make available (the "SDKs");
• the sandbox and test environments; and
• our developer documentation, schemas and reference material (the "Documentation").

These Developer Terms are an addendum to the Vitabyte Terms of Service (the "Terms"), and the Acceptable Use Policy applies to all use of the APIs. The Terms govern everything these Developer Terms do not address, including governing law, venue, limits of liability, liquidated damages, injunctive relief, audit rights and acceptance records. If these Developer Terms and the Terms conflict on a subject these Developer Terms cover, these Developer Terms control on that subject.

You accept these Developer Terms when you create an API key, OAuth client or sandbox account, by ticking the unchecked acceptance box. If you create it for an organization, you also type your full name and title. That typed name and title is your electronic signature, and it binds the organization to these Developer Terms for every key created under it. You confirm you have authority to do so.

We record each acceptance with the document version, a SHA-256 hash of the text shown, the time, your IP address and your user agent, in an append-only log.

Subject to these Developer Terms, Vitabyte grants you a limited, non-exclusive, non-transferable, non-sublicensable, revocable licence during your subscription to:

• call the APIs, using Credentials we issue to you, in accordance with the Documentation;
• use the SDKs, in object code form or in the source form we publish, only to build and run your integration with the APIs; and
• copy and adapt sample code from the Documentation for the same purpose.

"Your integration" means software you build or operate to connect your own business systems, or a system you operate for a Vitabyte customer that has authorized you, to the APIs. You may use the APIs only with data that you, or the customer you act for, are entitled to access under the Terms and the permissions of the Credential used.

Vitabyte keeps all right, title and interest in the APIs, SDKs, Documentation and schemas. All rights not expressly granted are reserved.

Credentials are confidential and are access controls that Vitabyte uses to protect the APIs and our customers' data. You must:

• keep every secret Credential secret, stored only in a secure server-side secret store;
• never embed a secret Credential in a mobile app, browser code, desktop app, device firmware, public repository or any software distributed to others; use the public or restricted key types the Documentation provides for client-side use;
• give each key only the scopes your integration needs, and use separate keys for separate integrations and environments;
• rotate Credentials on the schedule the Documentation recommends, and immediately when a person with access leaves or a Credential may have been exposed; and
• not share, sell or transfer a Credential to anyone outside your organization, other than a contractor who is bound to these Developer Terms and acts only for you.

You are responsible for every call made with your Credentials, whether or not you authorized it.

Circumventing, forging, replaying or sharing Credentials to obtain access you are not entitled to may violate 17 U.S.C. §1201 in addition to these Developer Terms.

Each key is subject to the rate, concurrency and volume limits published in the Documentation or shown in your developer settings. We may change limits, and may set lower limits for a key that we reasonably believe threatens service stability.

You must not circumvent a limit, including by spreading traffic across multiple keys, accounts, organizations or IP addresses, by creating accounts to obtain extra quota, or by ignoring retry and back-off instructions. Calls above a limit may be rejected, delayed or billed as stated in your plan.

You must not, and must not help or allow anyone else to:

1. use the APIs for any purpose other than your integration as defined in Section 3;
2. access, request or store data you are not entitled to, or attempt to exceed the scope, location or account binding of a Credential;
3. scrape, crawl, harvest or bulk-extract data from the APIs, the portal or any Vitabyte service, or call any endpoint, parameter or method that is not documented for public use;
4. reverse engineer, decompile or disassemble any SDK, client library or compiled tool, or probe, map or attempt to discover undocumented endpoints, except where applicable law expressly forbids this restriction and then only after a written request sent by mail (certified mail or courier) to Vitabyte, Inc., Attn: George Karabelas, CEO, 3525 30th Ave, Suite 306, Astoria, NY 11103 that we have not answered in a reasonable time;
5. use the APIs, SDKs, Documentation or schemas to build a competing service, a substitute for any Vitabyte product, or an API that reproduces or is substantially similar to ours ("a clone");
6. benchmark the APIs, or publish performance or availability results, for competitive purposes without our written consent;
7. probe, scan or test the security of the APIs except through a disclosure programme we publish, or interfere with or disrupt the APIs or other customers' use of them;
8. resell, sublicense or provide access to the APIs as a stand-alone service; or
9. use the APIs in breach of law, card network rules or the Acceptable Use Policy.

Vitabyte's Documentation, API responses, schemas, error messages and sample code are our confidential and proprietary material, and API responses also contain our customers' data. Unless we agree otherwise in writing, you must not:

• use any of them to train, fine-tune, evaluate or improve a machine-learning model, large language model or AI agent;
• build or maintain an embedding store, vector index or retrieval corpus of them, other than a transient cache that is strictly necessary to operate your own integration and that you delete when it is no longer needed for that purpose;
• send them to a model provider or AI service that retains inputs or outputs to train or improve its models, or that does not contractually prohibit such retention; or
• use an AI system to systematically enumerate, summarize or reproduce the APIs or Documentation.

You may let an AI model or agent call the APIs as part of operating your own integration, provided the model's provider does not retain the data for training, the agent is bound by the Credential's scopes, and you remain responsible for every call it makes as if you made it.

An AI agent or automated system may place an order, make a booking or make a payment on a person's behalf only through the documented agentic-commerce interface, and only:

• within the spending caps, merchant limits and rate limits that interface enforces;
• with the person's informed, specific consent, captured and recorded the way the Documentation requires;
• without misrepresenting to the merchant or the person that a human, rather than an agent, is acting; and
• with the agent identifying itself and the person it acts for as the interface requires.

You must not use any other API, the portal, a guest page or a browser automation to order or pay for someone by automated means. You are responsible for orders and payments your agent makes, including disputes, refunds and any consent you failed to obtain.

If you register a webhook endpoint, you must:

• use HTTPS with a valid certificate;
• verify the signature on every delivery using the signing secret we issue, and reject unsigned or invalid deliveries;
• respond promptly and handle repeat deliveries idempotently, since we may retry and deliver an event more than once or out of order; and
• treat a webhook as a notice, and confirm money or state-changing events by calling the API before relying on them.

We may disable an endpoint that repeatedly fails or returns errors, and will notify you when we do.

Data you receive through the APIs that relates to our customers, their staff, guests or cardholders is protected by the Terms, our Privacy Policy and the Data Processing Addendum, which apply to your processing of it. In particular you must:

• use it only for your integration and only as the data owner has authorized;
• keep it secure with appropriate technical and organizational measures;
• not sell it, use it for advertising or profiling, or combine it with other data to identify individuals beyond what your integration requires; and
• never request, receive or store full card numbers, card verification codes or PINs through the APIs, other than through a tokenized payment flow we document.

You must notify Vitabyte in writing by mail (certified mail or courier) to Vitabyte, Inc., Attn: George Karabelas, CEO, 3525 30th Ave, Suite 306, Astoria, NY 11103, sent within 24 hours of learning or reasonably suspecting that a Credential, signing secret or system holding data obtained through the APIs has been compromised. You will immediately revoke and rotate the affected Credentials, cooperate with our investigation, and give us the information we reasonably request. You will not notify our customers or the public about an incident involving Vitabyte systems without first consulting us, unless the law requires you to.

The sandbox is for development and testing. In the sandbox you must use only fictitious data. You must not enter real card numbers, real personal data, real employee or guest data, or production Credentials. Test card numbers published in the Documentation are the only card data permitted. The sandbox has no uptime commitment, may be reset without notice, and transactions there have no financial effect. You must not use the sandbox to carry on live business or to test load beyond the limits we publish.

Monitoring. We may monitor API use, including volume, patterns, endpoints called, errors and content where needed, to operate and secure the APIs, enforce these Developer Terms and bill you.

Suspension. We may throttle, suspend or revoke any Credential or your API access, with or without notice, if we reasonably believe it is compromised, is being used in breach of these Developer Terms, threatens the security or stability of our services or other customers, or if fees are overdue. We will restore access once the cause is resolved where appropriate.

Changes and deprecation. We may change, add to, version or deprecate any API or SDK. For a breaking change to a generally available API, we will give notice in the Documentation or by email, where practicable at least 90 days in advance, unless the change is needed for security, legal compliance or to prevent harm. Beta, preview and sandbox features may change or end at any time.

You may say that your integration "works with" or "integrates with" the relevant Vitabyte product, accurately and in plain text, and use our marks only as our published brand guidelines allow. You must not imply that Vitabyte endorses, sponsors or certifies your product, use our marks in your product name, domain or app-store listing, or alter our marks. Where the Documentation requires attribution on a screen that displays data from the APIs, you must show it.

Neither party may issue a press release naming the other about your integration without the other's written consent. If you give us suggestions or feedback about the APIs, we may use them freely without obligation to you.

On request, you will provide records reasonably needed to verify compliance with these Developer Terms, including logs of API calls made with your Credentials, a description of where data obtained through the APIs is stored and who can access it, and evidence of Credential rotation and deletion. You will provide them within 30 days, or sooner if we are investigating a suspected security incident or misuse. The audit rights in the Terms also apply.

These Developer Terms apply for as long as you hold a Credential or use the APIs. Either party may end them as described in the Terms, and you may end them at any time by revoking all your Credentials. We may end them immediately on notice if you materially breach Section 4, 6, 7, 8 or 10.

When they end:

1. we will revoke your Credentials and disable your webhook endpoints;
2. you must stop using the APIs, SDKs and Documentation;
3. you must delete all data obtained through the APIs, including caches, copies and backups, within 30 days, except data that the customer who owns it has directed you to keep under your own agreement with them, or that the law requires you to keep; and
4. on request, an officer will certify the deletion in writing.

Sections 3 (ownership), 6, 7, 10, 11, 16, 17, 18 and 19 survive termination.

The APIs, SDKs, sandbox and Documentation are provided "as is" and "as available". To the fullest extent permitted by law, Vitabyte disclaims all implied warranties, including merchantability, fitness for a particular purpose, title and non-infringement. Beta and preview features carry no commitment of any kind.

The limits and exclusions of liability in the Terms apply. You are responsible for your integration, for the acts of any agent or contractor using your Credentials, and for claims arising from your use of data obtained through the APIs, and you will defend and indemnify Vitabyte against such claims as described in the Terms.

A breach of Section 4, 6, 7, 8 or 10 could cause Vitabyte and its customers irreparable harm for which money damages alone would not be adequate. Vitabyte may seek injunctive relief, specific performance and other equitable relief in addition to any other remedy, without posting a bond where the law allows. The liquidated damages provisions of the Terms apply to unauthorized extraction, scraping, model training, competitive use and circumvention under these Developer Terms, in addition to any fees owed.

You may not assign these Developer Terms without our written consent. If any provision is held unenforceable, it will be enforced to the maximum extent permitted and the rest remains in effect. A failure to enforce is not a waiver. We may update these Developer Terms with notice of any material change, and you will be asked to accept the new version before it applies to you, except where a change is required by law or for security.

Vitabyte, Inc., Attn: George Karabelas, CEO, 3525 30th Ave, Suite 306, Astoria, NY 11103

Notices, incident notices and legal matters: in writing by mail (certified mail or courier) to the address above.

Signed for Vitabyte, Inc.: George Karabelas, Chief Executive Officer, Vitabyte, Inc.