Dodam AI REST API Terms

(1) These Terms set the conditions for using the Dodam AI REST API ("the API"). They are an addendum to the Terms of Service; anything not covered here follows the Terms of Service and the Privacy Policy.

(2) The API is authenticated with an organization API key and exposes the same capabilities as the app: creating inspections, reading results, deciding findings, applying fixes, re-inspecting and downloading outputs.

(3) Your first API call is treated as acceptance of these Terms.

(1) Only organization owners and admins can create and revoke API keys. The full value is shown once, at creation. The Company stores only a hash, never the original, so a lost key must be replaced.

(2) Keep keys in server-side environment variables or a secret manager. You must not:

1. 1.Embed a key in client code such as a browser bundle or a mobile app.
2. 2.Expose a key in a public repository, documentation, screenshot or log.
3. 3.Transfer, lend or share a key with a third party.

(3) If you suspect a key has leaked, revoke it immediately and issue a new one. Until it is revoked, you are responsible for the calls made with it, the usage they incur and their results.

(4) If the Company detects signs of a leaked key it notifies you and may revoke that key immediately where necessary to protect the Service.

(5) Keys carry scopes. Grant only the minimum scope each integration needs.

(1) The Company applies the following limits to keep the Service stable. Current values are published in the API documentation and in response headers.

(2) On a 429, retry with exponential backoff (start at one second and double each attempt). Repeated calls without backoff may lead to the key being blocked temporarily.

(3) Usage counting and disputes follow Article 7 of the Refund and Cancellation Policy.

(4) The Company may adjust the limits, and gives 30 days' notice before lowering one.

When using the API you must not:

1. 1.Resell the API or inspection results, or offer a substantially equivalent service to third parties, without the Company's written consent.
2. 2.Make bulk repeated calls in order to extract or replicate the inspection rules, verdict logic or prompts.
3. 3.Create multiple accounts or keys to get around the limits.
4. 4.Crawl or scrape the Service screens or responses without permission.
5. 5.Run load tests, vulnerability scans or other tests that affect availability without agreeing them in advance.
6. 6.Send material that infringes someone's rights, or content prohibited by law, through the API.
7. 7.Present the source links or rule summaries in a response as if they did not come from the Company.

Load testing and security assessments are allowed once you tell admin@vanillax.co the scope and schedule in advance and the Company confirms.

(1) Rights in images and product copy sent through the API stay with you or the original rights holder, and the Company processes them only for the purposes set out in Article 11 of the Terms of Service.

(2) API request and response records (timestamp, endpoint, status code, usage) are kept for 3 months for usage counting and incident response. Request bodies (images and text) are never written to logs.

(3) If you send your own customers' personal data through the API, you are the controller (entrusting party) and the Company is the processor. The roles and duties in that case follow the Data Processing Addendum.

(4) If you store personal data from API responses in your own systems, you must apply your own retention periods and destruction procedures to it.

(1) The API is versioned in the path (for example /api/v1). Changes are announced as follows.

(2) Notices go out through the API documentation, in-app announcements and email to organization owners and admins.

(3) Urgent changes, such as fixing a security vulnerability, may be made without prior notice and are announced without delay afterwards.

(1) The Company works to keep the API available at all times but does not warrant an availability rate unless a separate written contract says so.

(2) Scheduled maintenance is announced at least 24 hours in advance and, wherever possible, performed overnight Korea time.

(3) If you breach Article 4, or if there is a serious threat to the stability of the Service, the Company may block calls from the key concerned. It notifies the reason by email and gives you an opportunity to respond.

Scores, verdicts, findings and fix suggestions in API responses are the same advisory material as in the app, and Articles 13 and 17 of the Terms of Service apply unchanged. If you pass API responses on to your own customers, make their nature and limits clear to them.

These Terms take effect on 2026-09-03. Amendments follow the procedure in Article 3 of the Terms of Service.